{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.50.36.175", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp neighbors", "show logging | include BGP", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.93.166.76", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf database", "show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.249.5.148", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf database", "show ip ospf neighbor", "show interfaces"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.241.77.119", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.80.168.218", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip verify source", "show arp", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.148.210.207", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.15.64.138", "event": "port scan detected", "severity": "low"}, "requested_show": ["show logging | include DENY", "show firewall", "show conn", "show access-lists"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.183.107.125", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.103.77.1", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp neighbors", "show logging | include BGP", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.128.200.149", "event": "port scan detected", "severity": "low"}, "requested_show": ["show logging | include DENY", "show firewall", "show conn"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.2.56.123", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.124.166.100", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show users", "show logging | include SSH", "show access-lists", "show ip ssh", "show run | include vty"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.132.51.236", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.107.6.185", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip route", "show ip bgp neighbors", "show ip bgp summary", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.145.167.37", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.217.109.135", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf database"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.65.107.134", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show ip traffic", "show conn", "show logging | include DENY", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.1.3.15", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip verify source", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.182.103.248", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show platform resources", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.72.5.12", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show platform resources", "show interfaces counters errors", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.132.43.168", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show users", "show access-lists", "show logging | include SSH", "show ip ssh", "show run | include vty", "show ip interface brief"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.191.139.39", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show ip verify source", "show ip traffic", "show mac address-table"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.123.254.145", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf interface", "show ip ospf database", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.143.78.72", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show mac address-table", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.174.7.239", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show memory statistics", "show platform resources", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.232.156.183", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip cef", "show ip route", "show ip bgp neighbors", "show ip bgp summary", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.152.34.162", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.169.184.55", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show arp", "show ip traffic", "show mac address-table", "show ip verify source"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.117.216.4", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show conn", "show firewall", "show logging | include DENY", "show ip traffic", "show access-lists"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.204.78.92", "event": "port scan detected", "severity": "high"}, "requested_show": ["show logging | include DENY", "show access-lists", "show firewall", "show conn", "show ip traffic"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.249.7.39", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip ssh", "show access-lists", "show users", "show ip interface brief"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.50.160.159", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show users", "show run | include vty", "show ip interface brief", "show ip ssh"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.91.63.27", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show mac address-table", "show arp", "show ip traffic"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.167.149.173", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.180.209.85", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show conn", "show ip traffic", "show firewall", "show access-lists"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.254.77.182", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip route", "show logging | include BGP", "show ip cef"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.30.219.137", "event": "port scan detected", "severity": "high"}, "requested_show": ["show logging | include DENY", "show access-lists", "show conn", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.173.122.184", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show run | include vty", "show users", "show access-lists", "show ip interface brief"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.69.78.3", "event": "port scan detected", "severity": "high"}, "requested_show": ["show firewall", "show ip traffic", "show conn", "show access-lists", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.6.158.4", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.183.214.193", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip verify source", "show mac address-table", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.112.82.103", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip ssh", "show ip interface brief", "show access-lists", "show run | include vty"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.172.51.153", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show interfaces counters errors", "show memory statistics"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.18.53.180", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show users", "show access-lists", "show ip interface brief", "show run | include vty", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.25.175.218", "event": "port scan detected", "severity": "low"}, "requested_show": ["show access-lists", "show ip traffic", "show conn"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.137.155.10", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip verify source", "show mac address-table", "show arp"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.225.172.155", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.35.255.171", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show logging | include BGP", "show ip bgp summary", "show ip cef", "show ip route"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.97.241.181", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show logging | include BGP", "show ip bgp neighbors", "show ip bgp summary", "show ip cef"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.60.68.188", "event": "port scan detected", "severity": "high"}, "requested_show": ["show access-lists", "show logging | include DENY", "show firewall"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.245.10.42", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show access-lists", "show ip interface brief", "show logging | include SSH", "show ip ssh", "show users"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.41.219.123", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show interfaces", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.94.80.184", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp summary", "show ip cef", "show logging | include BGP", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.171.136.174", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf database", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.161.12.31", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show ip traffic", "show firewall", "show logging | include DENY", "show access-lists"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.29.169.2", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.70.8.173", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.224.198.190", "event": "port scan detected", "severity": "high"}, "requested_show": ["show logging | include DENY", "show ip traffic", "show conn"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.138.50.234", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.210.116.77", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show access-lists", "show ip traffic", "show conn", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.64.12.145", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.244.231.179", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show interfaces", "show ip ospf neighbor", "show ip ospf interface", "show ip ospf database"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.163.39.78", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf interface", "show ip ospf database"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.125.244.88", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip traffic", "show arp", "show mac address-table", "show ip verify source"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.86.142.215", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging | include SSH", "show ip ssh", "show users", "show ip interface brief", "show run | include vty"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.196.140.119", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip verify source", "show arp", "show ip traffic"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.115.151.251", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show interfaces counters errors", "show platform resources", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.198.108.220", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show platform resources"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.145.136.3", "event": "port scan detected", "severity": "high"}, "requested_show": ["show access-lists", "show firewall", "show conn"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.223.60.156", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf database", "show interfaces", "show ip ospf neighbor", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.228.88.128", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show ip ssh", "show logging | include SSH", "show ip interface brief", "show users", "show access-lists"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.192.174.76", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show platform resources", "show interfaces counters errors", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.148.100.62", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show platform resources", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.127.25.159", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.8.76.225", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.158.64.129", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show interfaces", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.184.180.183", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.230.217.234", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show access-lists", "show firewall", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.70.27.44", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.246.115.245", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip traffic", "show arp", "show mac address-table", "show ip verify source"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.50.41.122", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip ssh", "show ip interface brief", "show run | include vty", "show access-lists"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.147.24.193", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp neighbors", "show logging | include BGP", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.52.63.193", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip interface brief", "show access-lists", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.189.173.193", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show access-lists", "show ip ssh", "show users"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.7.161.246", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show arp", "show ip traffic", "show ip verify source", "show mac address-table"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.83.216.195", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip ssh", "show logging | include SSH", "show ip interface brief", "show run | include vty"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.183.30.78", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf interface", "show ip ospf database", "show ip ospf neighbor", "show interfaces"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.185.193.230", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp summary", "show ip cef", "show ip route", "show logging | include BGP", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.166.31.130", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp neighbors", "show ip bgp summary", "show ip cef", "show ip route", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.70.21.33", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic", "show ip verify source"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.25.101.70", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show interfaces counters errors", "show platform resources"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.184.87.247", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.165.76.62", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.22.216.96", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp neighbors", "show ip route", "show ip cef", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.186.202.12", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.217.81.182", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show logging | include BGP", "show ip cef", "show ip bgp neighbors", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.242.235.71", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.250.235.40", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp neighbors", "show ip cef", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.123.252.87", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip traffic", "show ip verify source", "show arp", "show mac address-table"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.218.36.77", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show memory statistics", "show platform resources", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.37.85.63", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.196.130.135", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip verify source", "show arp", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.205.27.138", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show users", "show ip ssh", "show ip interface brief", "show logging | include SSH", "show access-lists"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.147.224.140", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp neighbors", "show ip cef", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.123.35.28", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show platform resources", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.246.186.240", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show access-lists", "show ip traffic", "show firewall", "show conn"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.172.192.229", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show run | include vty", "show ip ssh", "show users", "show ip interface brief", "show access-lists", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.55.83.174", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show interfaces", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.232.41.131", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show interfaces"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.133.239.162", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp summary", "show ip cef", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.248.209.218", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show access-lists", "show logging | include DENY", "show ip traffic"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.206.189.194", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp neighbors", "show ip cef", "show ip route", "show logging | include BGP", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.195.142.246", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show logging | include DENY", "show access-lists", "show conn", "show ip traffic"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.71.11.216", "event": "port scan detected", "severity": "low"}, "requested_show": ["show ip traffic", "show firewall", "show conn"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.213.162.53", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show logging | include BGP", "show ip bgp neighbors", "show ip cef"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.192.112.207", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip traffic", "show ip verify source", "show arp", "show mac address-table"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.54.212.4", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show memory statistics", "show processes cpu sorted", "show platform resources", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.186.6.100", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show ip interface brief", "show users", "show logging | include SSH", "show run | include vty", "show ip ssh"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.234.145.51", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show logging | include DENY", "show firewall", "show access-lists", "show conn"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.59.22.214", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip cef", "show ip bgp summary", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.94.44.34", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.242.7.173", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show logging | include SSH", "show access-lists", "show ip interface brief", "show ip ssh", "show run | include vty", "show users"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.236.112.206", "event": "port scan detected", "severity": "high"}, "requested_show": ["show conn", "show access-lists", "show ip traffic", "show logging | include DENY", "show firewall"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.184.183.208", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show platform resources", "show processes cpu sorted", "show memory statistics", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.8.123.176", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show users", "show run | include vty", "show logging | include SSH", "show ip interface brief"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.41.40.171", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.243.77.27", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show ip ospf database", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.48.36.111", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show users", "show run | include vty", "show access-lists", "show ip interface brief", "show ip ssh", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.255.40.84", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show mac address-table", "show ip traffic", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.130.123.246", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show mac address-table", "show ip traffic", "show ip verify source"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.160.218.23", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.144.245.217", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp neighbors", "show ip cef", "show ip route"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.227.251.12", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip route", "show logging | include BGP", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.94.106.133", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.212.180.79", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show firewall", "show ip traffic", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.28.133.145", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show access-lists", "show firewall", "show logging | include DENY", "show conn"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.144.241.47", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show memory statistics", "show interfaces counters errors", "show platform resources"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.105.100.106", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.247.113.177", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show access-lists", "show logging | include DENY", "show conn", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.64.47.31", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show ip ospf database", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.27.191.18", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show arp", "show mac address-table", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.209.54.206", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show arp", "show ip traffic", "show ip verify source", "show mac address-table"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.110.23.147", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show platform resources", "show processes cpu sorted", "show memory statistics", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.92.63.219", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.248.173.77", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show platform resources"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.78.179.149", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp summary", "show ip cef", "show ip bgp neighbors", "show ip route", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.143.110.234", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.223.26.141", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show mac address-table", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.47.37.88", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip verify source", "show arp", "show ip traffic"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.115.108.140", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show firewall", "show conn", "show ip traffic"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.52.39.47", "event": "port scan detected", "severity": "low"}, "requested_show": ["show conn", "show logging | include DENY", "show ip traffic", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.148.112.142", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show users", "show ip ssh", "show access-lists", "show run | include vty", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.82.72.183", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip verify source", "show arp", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.24.63.160", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show logging | include BGP", "show ip bgp summary", "show ip route", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.89.80.185", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show access-lists", "show users", "show ip interface brief"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.204.165.160", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.4.17.247", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.221.79.68", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.214.22.21", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.150.226.228", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show interfaces counters errors", "show processes cpu sorted", "show memory statistics", "show platform resources"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.85.57.34", "event": "port scan detected", "severity": "high"}, "requested_show": ["show firewall", "show conn", "show access-lists", "show ip traffic"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.156.177.213", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf interface", "show ip ospf database", "show ip ospf neighbor", "show interfaces"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.160.187.83", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show memory statistics", "show interfaces counters errors", "show platform resources", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.10.129.197", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show ip ospf database", "show interfaces", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.172.176.141", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.117.166.193", "event": "port scan detected", "severity": "low"}, "requested_show": ["show ip traffic", "show logging | include DENY", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.67.190.34", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.109.105.103", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show memory statistics", "show interfaces counters errors", "show processes cpu sorted", "show platform resources"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.91.181.37", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show logging | include BGP", "show ip bgp neighbors", "show ip route", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.33.145.210", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf database", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.216.8.166", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.76.230.118", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show access-lists", "show firewall", "show ip traffic", "show conn", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.151.236.190", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show mac address-table", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.167.94.106", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.109.81.151", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show access-lists", "show ip traffic", "show conn", "show firewall"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.199.105.104", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.124.7.242", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf database", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.68.57.88", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip route", "show logging | include BGP", "show ip cef", "show ip bgp summary", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.148.13.117", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.78.219.158", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.7.161.236", "event": "port scan detected", "severity": "high"}, "requested_show": ["show conn", "show access-lists", "show ip traffic", "show firewall", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.240.42.23", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show access-lists", "show ip ssh", "show run | include vty", "show users"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.91.61.68", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.119.61.50", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.123.199.249", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show interfaces", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.0.195.63", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show users", "show ip interface brief", "show logging | include SSH", "show run | include vty", "show access-lists", "show ip ssh"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.86.171.14", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show interfaces", "show ip ospf neighbor", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.139.38.158", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show interfaces counters errors", "show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.240.40.212", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip traffic", "show ip verify source", "show mac address-table"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.158.198.68", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip interface brief", "show access-lists", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.99.59.47", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show mac address-table", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.102.83.86", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show ip traffic", "show access-lists", "show firewall", "show conn", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.197.69.115", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show mac address-table", "show arp", "show ip traffic", "show ip verify source"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.147.158.159", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show platform resources", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.103.207.8", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show access-lists", "show logging | include DENY", "show ip traffic", "show conn", "show firewall"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.37.136.19", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show access-lists", "show logging | include SSH", "show ip interface brief"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.24.34.66", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show logging | include SSH", "show run | include vty", "show ip interface brief"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.221.10.205", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip interface brief", "show users", "show access-lists", "show run | include vty", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.218.87.223", "event": "port scan detected", "severity": "low"}, "requested_show": ["show firewall", "show access-lists", "show logging | include DENY", "show conn", "show ip traffic"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.113.169.204", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show platform resources", "show interfaces counters errors", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.81.155.215", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf interface", "show ip ospf database"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.212.124.239", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show users", "show access-lists", "show run | include vty", "show ip interface brief", "show logging | include SSH", "show ip ssh"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.69.155.203", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip cef", "show ip route", "show ip bgp summary", "show logging | include BGP", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.13.141.80", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show mac address-table", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.231.99.248", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.186.250.38", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show memory statistics", "show interfaces counters errors", "show processes cpu sorted", "show platform resources"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.59.47.231", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show run | include vty", "show ip interface brief", "show access-lists", "show logging | include SSH", "show users", "show ip ssh"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.61.188.60", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show platform resources", "show memory statistics", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.137.223.137", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show logging | include SSH", "show ip interface brief", "show run | include vty", "show ip ssh", "show access-lists"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.116.111.153", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip cef", "show ip bgp summary", "show ip bgp neighbors", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.54.12.98", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show ip ssh", "show ip interface brief", "show logging | include SSH", "show run | include vty", "show access-lists"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.251.84.194", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf database", "show interfaces", "show ip ospf interface", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.123.160.148", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show logging | include DENY", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.103.94.82", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show mac address-table", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.7.194.234", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf database", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.8.20.119", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show ip ssh", "show logging | include SSH", "show run | include vty"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.10.48.178", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf interface", "show ip ospf database", "show interfaces", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.141.200.208", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.133.38.155", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show arp", "show mac address-table", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.26.205.83", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip verify source", "show mac address-table", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.213.195.229", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show ip interface brief", "show users", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.97.132.78", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.225.7.246", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.92.223.159", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf interface", "show ip ospf database"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.108.0.55", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show run | include vty", "show logging | include SSH", "show ip interface brief", "show users", "show ip ssh"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.205.221.73", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip route", "show ip cef", "show ip bgp summary", "show ip bgp neighbors", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.255.152.65", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.37.93.163", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show ip ssh", "show run | include vty", "show ip interface brief", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.59.30.80", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show platform resources", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.236.157.220", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show platform resources", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.5.186.228", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip interface brief", "show ip ssh", "show users", "show access-lists", "show run | include vty"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.117.226.70", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf database", "show interfaces", "show ip ospf interface", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.75.113.117", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf neighbor", "show ip ospf database", "show interfaces"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.3.207.74", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.146.125.73", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.7.127.236", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip cef", "show ip bgp neighbors", "show logging | include BGP", "show ip route"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.211.144.189", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.243.178.159", "event": "port scan detected", "severity": "low"}, "requested_show": ["show firewall", "show access-lists", "show ip traffic", "show conn", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.218.148.250", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show logging | include BGP", "show ip route", "show ip bgp summary", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.0.222.151", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip ssh", "show ip interface brief", "show access-lists"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.148.186.85", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show run | include vty", "show ip ssh", "show ip interface brief", "show users", "show access-lists"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.240.234.244", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show logging | include BGP", "show ip bgp summary", "show ip route", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.117.136.165", "event": "port scan detected", "severity": "high"}, "requested_show": ["show access-lists", "show logging | include DENY", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.252.250.93", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show platform resources", "show memory statistics", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.252.4.16", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show interfaces counters errors", "show platform resources"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.72.35.149", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show access-lists", "show logging | include DENY", "show ip traffic", "show firewall"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.212.168.152", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp neighbors", "show ip bgp summary", "show ip route", "show logging | include BGP", "show ip cef"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.21.6.12", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show logging | include SSH", "show ip ssh", "show users", "show access-lists", "show run | include vty", "show ip interface brief"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.179.193.95", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show processes cpu sorted", "show interfaces counters errors", "show memory statistics", "show platform resources"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.227.69.30", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show memory statistics", "show processes cpu sorted", "show platform resources"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.240.173.214", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp summary", "show ip route", "show ip bgp neighbors", "show logging | include BGP", "show ip cef"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.179.24.74", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip verify source", "show arp", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.41.67.251", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.240.132.183", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.199.227.25", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show logging | include SSH", "show ip ssh", "show run | include vty"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.78.160.6", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show logging | include BGP", "show ip bgp neighbors", "show ip route", "show ip cef"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.200.160.47", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show access-lists", "show conn", "show ip traffic", "show firewall", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.205.176.35", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp summary", "show ip route", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.186.163.25", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip traffic", "show ip verify source", "show arp", "show mac address-table"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.19.104.151", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show firewall", "show conn", "show ip traffic", "show logging | include DENY", "show access-lists"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.28.43.232", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp neighbors", "show ip cef", "show ip route", "show ip bgp summary", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.183.35.212", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip traffic", "show mac address-table", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.195.235.150", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show ip ssh", "show users", "show ip interface brief", "show access-lists"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.84.58.99", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip traffic", "show arp", "show ip verify source", "show mac address-table"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.124.250.54", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show ip route", "show ip cef", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.78.8.187", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.104.202.164", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.227.133.188", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show mac address-table", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.144.135.207", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show memory statistics", "show processes cpu sorted", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.47.217.122", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show memory statistics", "show platform resources", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.151.241.132", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show ip ospf database", "show interfaces"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.243.188.107", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show platform resources", "show memory statistics", "show processes cpu sorted", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.8.160.232", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.31.57.62", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip verify source", "show arp", "show ip traffic"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.221.148.238", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.98.0.128", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip cef", "show ip bgp neighbors", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.146.120.45", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show ip ospf database", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.227.118.104", "event": "port scan detected", "severity": "high"}, "requested_show": ["show firewall", "show ip traffic", "show logging | include DENY", "show conn", "show access-lists"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.158.72.180", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp neighbors", "show ip route", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.233.178.104", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show users", "show ip interface brief", "show logging | include SSH", "show ip ssh", "show access-lists"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.71.33.93", "event": "port scan detected", "severity": "high"}, "requested_show": ["show ip traffic", "show firewall", "show conn", "show access-lists"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.60.93.233", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.184.124.51", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.73.49.250", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show ip traffic", "show access-lists"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.108.47.88", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.179.199.215", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.125.28.5", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show platform resources", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.79.157.108", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.102.130.177", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show logging | include BGP", "show ip cef", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.237.223.130", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show access-lists", "show users", "show run | include vty", "show ip ssh", "show ip interface brief", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.218.103.115", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show access-lists", "show ip traffic", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.140.43.244", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.149.225.173", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show interfaces counters errors", "show platform resources"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.81.150.217", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.198.218.181", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.227.72.42", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show mac address-table", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.198.190.44", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.180.196.246", "event": "port scan detected", "severity": "high"}, "requested_show": ["show access-lists", "show ip traffic", "show logging | include DENY", "show firewall"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.49.143.60", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show logging | include SSH", "show run | include vty", "show ip interface brief", "show users", "show access-lists", "show ip ssh"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.163.39.101", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show mac address-table", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.93.51.110", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.174.250.254", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show arp", "show ip traffic", "show mac address-table"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.207.60.212", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.233.176.131", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show users", "show access-lists", "show ip interface brief"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.155.44.75", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip verify source", "show mac address-table", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.183.170.192", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.144.153.73", "event": "port scan detected", "severity": "low"}, "requested_show": ["show access-lists", "show conn", "show logging | include DENY", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.224.135.193", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show users", "show logging | include SSH", "show ip ssh", "show ip interface brief", "show access-lists"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.73.102.233", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.11.67.135", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip verify source", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.3.234.153", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.38.159.78", "event": "port scan detected", "severity": "low"}, "requested_show": ["show firewall", "show conn", "show ip traffic", "show access-lists"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.62.135.116", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show users", "show logging | include SSH", "show ip ssh", "show ip interface brief", "show access-lists", "show run | include vty"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.253.215.45", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.96.152.16", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.109.211.22", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.167.159.41", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.85.116.99", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.174.0.26", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show ip traffic", "show mac address-table"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.118.89.167", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp neighbors", "show ip route", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.201.16.244", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show platform resources", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.11.2.231", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.250.27.183", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip cef", "show logging | include BGP", "show ip bgp summary", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.156.130.130", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show interfaces", "show ip ospf neighbor", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.228.212.150", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show memory statistics", "show platform resources", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.137.124.189", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp neighbors", "show ip cef", "show ip bgp summary", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.42.18.67", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.13.63.47", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip interface brief", "show run | include vty", "show access-lists"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.116.184.96", "event": "port scan detected", "severity": "high"}, "requested_show": ["show firewall", "show logging | include DENY", "show conn", "show access-lists", "show ip traffic"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.225.78.70", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show ip ssh", "show run | include vty", "show ip interface brief"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.141.128.216", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show logging | include SSH", "show ip interface brief", "show users", "show access-lists"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.184.71.158", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip cef", "show ip bgp neighbors", "show ip route"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.182.201.158", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.105.222.150", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show ip traffic", "show access-lists", "show firewall", "show conn", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.28.243.191", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf database"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.17.46.172", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show users", "show logging | include SSH", "show ip interface brief", "show run | include vty", "show ip ssh"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.85.14.155", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.138.104.118", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show logging | include DENY", "show ip traffic", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.50.4.159", "event": "port scan detected", "severity": "low"}, "requested_show": ["show firewall", "show ip traffic", "show conn"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.14.203.203", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show ip ssh", "show logging | include SSH", "show users", "show ip interface brief"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.185.119.63", "event": "port scan detected", "severity": "high"}, "requested_show": ["show logging | include DENY", "show ip traffic", "show conn", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.248.184.63", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show memory statistics", "show processes cpu sorted", "show platform resources"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.192.186.37", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.252.176.90", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show users", "show access-lists", "show ip ssh", "show logging | include SSH", "show run | include vty"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.198.215.132", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show interfaces counters errors", "show platform resources"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.185.140.15", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show run | include vty", "show users", "show ip interface brief", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.169.176.23", "event": "port scan detected", "severity": "high"}, "requested_show": ["show access-lists", "show ip traffic", "show firewall", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.138.61.124", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show interfaces counters errors", "show platform resources", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.158.153.144", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show access-lists", "show logging | include SSH", "show run | include vty", "show users", "show ip interface brief", "show ip ssh"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.171.210.25", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show access-lists", "show run | include vty", "show logging | include SSH", "show ip interface brief", "show ip ssh", "show users"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.26.105.183", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp neighbors", "show ip bgp summary", "show ip cef"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.226.163.216", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.76.9.25", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show ip traffic", "show logging | include DENY", "show access-lists", "show firewall", "show conn"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.36.0.86", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show interfaces counters errors", "show processes cpu sorted", "show memory statistics", "show platform resources"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.7.135.34", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip route", "show logging | include BGP", "show ip cef", "show ip bgp summary", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.103.204.42", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show platform resources", "show interfaces counters errors", "show processes cpu sorted", "show memory statistics"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.77.121.109", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.229.88.77", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show platform resources", "show memory statistics", "show processes cpu sorted", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.123.22.105", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show access-lists", "show users", "show ip ssh", "show ip interface brief", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.8.204.49", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.79.172.154", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip traffic", "show ip verify source", "show mac address-table", "show arp"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.123.21.127", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf database", "show ip ospf neighbor", "show interfaces"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.197.18.150", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show firewall", "show conn", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.67.161.143", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp neighbors", "show ip bgp summary", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.65.200.249", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show interfaces counters errors", "show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.75.124.93", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip verify source", "show ip traffic", "show arp", "show mac address-table"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.210.53.174", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp summary", "show logging | include BGP", "show ip cef", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.167.177.241", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip route", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.19.49.185", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show users", "show ip ssh", "show ip interface brief"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.212.210.233", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.36.219.253", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.131.93.40", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.175.81.139", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show run | include vty", "show users", "show access-lists", "show ip interface brief", "show ip ssh"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.159.224.39", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show ip traffic", "show conn", "show firewall"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.141.45.181", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip route", "show ip bgp neighbors", "show ip cef", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.81.243.46", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show ip ssh", "show run | include vty", "show logging | include SSH", "show access-lists", "show ip interface brief", "show users"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.86.254.240", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.150.194.233", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf database", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.11.159.253", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.232.62.99", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show access-lists", "show run | include vty", "show ip ssh"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.189.71.195", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.45.244.15", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show platform resources", "show interfaces counters errors", "show memory statistics"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.235.251.87", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show mac address-table", "show ip verify source", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.119.250.18", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip interface brief", "show users", "show logging | include SSH", "show access-lists", "show run | include vty", "show ip ssh"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.24.20.136", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.218.134.189", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show ip cef", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.16.232.195", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show run | include vty", "show logging | include SSH", "show ip interface brief", "show users", "show ip ssh"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.119.87.207", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show ip traffic", "show conn", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.159.77.59", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.165.116.135", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip ssh", "show logging | include SSH", "show ip interface brief"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.148.84.36", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show platform resources", "show interfaces counters errors", "show processes cpu sorted", "show memory statistics"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.116.239.75", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.130.191.229", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip verify source", "show arp", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.191.157.123", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.80.188.27", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip interface brief", "show logging | include SSH", "show users", "show run | include vty", "show access-lists", "show ip ssh"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.92.57.15", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show interfaces counters errors", "show platform resources"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.168.66.99", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf database", "show interfaces", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.45.38.158", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show ip traffic", "show access-lists", "show conn", "show firewall"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.190.178.32", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show platform resources", "show interfaces counters errors", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.203.59.32", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show ip cef"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.164.240.122", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show access-lists", "show logging | include SSH", "show ip ssh"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.95.76.245", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.173.247.231", "event": "port scan detected", "severity": "low"}, "requested_show": ["show logging | include DENY", "show firewall", "show ip traffic", "show access-lists", "show conn"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.93.209.56", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show platform resources", "show processes cpu sorted", "show interfaces counters errors", "show memory statistics"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.114.67.20", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf database", "show ip ospf neighbor", "show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.9.184.69", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.77.188.112", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show mac address-table", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.220.99.139", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf neighbor", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.52.232.224", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip traffic", "show ip verify source", "show mac address-table", "show arp"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.86.233.137", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip ssh", "show run | include vty", "show access-lists", "show logging | include SSH", "show ip interface brief"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.122.220.197", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show firewall", "show ip traffic", "show logging | include DENY", "show conn", "show access-lists"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.128.249.254", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf interface", "show ip ospf database", "show ip ospf neighbor", "show interfaces"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.128.251.114", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip cef", "show ip route", "show logging | include BGP", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.232.190.14", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip verify source", "show mac address-table", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.219.235.226", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show firewall", "show access-lists", "show ip traffic"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.214.176.56", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf database", "show ip ospf interface", "show interfaces", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.27.133.220", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show access-lists", "show ip ssh", "show logging | include SSH", "show run | include vty", "show users"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.80.221.130", "event": "port scan detected", "severity": "high"}, "requested_show": ["show ip traffic", "show firewall", "show access-lists"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.111.88.214", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show users", "show ip ssh", "show access-lists", "show run | include vty", "show ip interface brief"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.232.215.17", "event": "port scan detected", "severity": "low"}, "requested_show": ["show logging | include DENY", "show firewall", "show conn"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.74.216.110", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip route", "show ip bgp neighbors", "show logging | include BGP", "show ip cef"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.35.85.5", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show mac address-table", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.240.183.1", "event": "port scan detected", "severity": "high"}, "requested_show": ["show firewall", "show conn", "show logging | include DENY", "show ip traffic"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.217.53.155", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.244.29.58", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show users", "show run | include vty", "show ip interface brief", "show access-lists", "show ip ssh"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.94.174.233", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show arp", "show ip verify source", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.95.181.110", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.230.247.4", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp neighbors", "show ip route", "show ip bgp summary", "show ip cef"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.47.159.99", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip traffic", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.138.29.136", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.95.190.190", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show access-lists", "show firewall", "show conn", "show ip traffic"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.48.205.132", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show platform resources", "show memory statistics", "show processes cpu sorted", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.254.93.37", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show access-lists", "show firewall", "show conn", "show ip traffic", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.237.135.48", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf database"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.235.151.57", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show interfaces", "show ip ospf database", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.201.104.181", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show mac address-table", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.188.154.183", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp neighbors", "show ip cef", "show ip route"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.102.55.244", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip traffic", "show arp", "show mac address-table", "show ip verify source"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.71.125.118", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip verify source", "show arp", "show ip traffic"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.219.17.243", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show logging | include DENY", "show access-lists", "show ip traffic"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.19.123.232", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show ip ospf database", "show interfaces"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.23.60.171", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.220.16.204", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.21.0.30", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.210.53.220", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show users", "show ip ssh", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.34.28.229", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf interface", "show ip ospf database", "show interfaces"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.10.189.29", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp summary", "show ip route", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.173.14.191", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.154.207.93", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show processes cpu sorted", "show interfaces counters errors", "show platform resources"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.204.15.158", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show logging | include BGP", "show ip route", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.21.146.16", "event": "port scan detected", "severity": "high"}, "requested_show": ["show conn", "show access-lists", "show ip traffic", "show firewall"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.170.73.51", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show firewall", "show conn", "show logging | include DENY", "show access-lists", "show ip traffic"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.107.44.89", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.94.117.186", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show platform resources", "show memory statistics", "show processes cpu sorted", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.72.74.74", "event": "port scan detected", "severity": "high"}, "requested_show": ["show ip traffic", "show access-lists", "show conn"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.228.70.53", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip ssh", "show access-lists", "show run | include vty"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.255.131.164", "event": "port scan detected", "severity": "low"}, "requested_show": ["show access-lists", "show conn", "show ip traffic"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.251.80.78", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip traffic", "show arp", "show ip verify source", "show mac address-table"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.173.199.218", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip route", "show ip bgp neighbors", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.99.28.138", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show mac address-table", "show arp", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.187.96.140", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.194.29.151", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show platform resources", "show memory statistics", "show processes cpu sorted", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.67.149.87", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show mac address-table", "show arp", "show ip traffic", "show ip verify source"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.117.119.68", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show interfaces", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.13.49.180", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show mac address-table", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.42.238.22", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show platform resources", "show interfaces counters errors", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.113.19.101", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.26.27.118", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.50.164.82", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.110.253.205", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.200.74.247", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show logging | include SSH", "show access-lists", "show run | include vty", "show ip interface brief", "show ip ssh"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.233.221.113", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.56.199.151", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.253.175.48", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.8.135.57", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging | include SSH", "show ip ssh", "show access-lists", "show run | include vty", "show ip interface brief", "show users"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.115.78.144", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.152.131.241", "event": "port scan detected", "severity": "high"}, "requested_show": ["show firewall", "show conn", "show access-lists", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.125.114.72", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show interfaces counters errors", "show memory statistics"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.3.31.254", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show conn", "show access-lists", "show firewall", "show logging | include DENY", "show ip traffic"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.194.125.26", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.204.91.113", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show interfaces counters errors", "show processes cpu sorted", "show memory statistics"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.239.109.228", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.134.112.11", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.51.253.143", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.2.127.122", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip cef", "show ip bgp neighbors", "show logging | include BGP", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.141.111.204", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.161.22.210", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show interfaces", "show ip ospf database", "show ip ospf neighbor", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.252.185.233", "event": "port scan detected", "severity": "high"}, "requested_show": ["show access-lists", "show logging | include DENY", "show conn", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.64.126.245", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show interfaces counters errors", "show platform resources", "show processes cpu sorted", "show memory statistics"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.118.168.188", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show platform resources", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.115.90.187", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip route", "show logging | include BGP", "show ip cef"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.118.52.142", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.198.183.96", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.188.46.42", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show mac address-table", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.47.4.37", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.122.91.236", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show memory statistics", "show platform resources", "show processes cpu sorted", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.89.157.230", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf database"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.80.93.114", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show arp", "show ip verify source", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.123.90.70", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show logging | include BGP", "show ip route", "show ip cef"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.55.57.213", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show logging | include DENY", "show firewall", "show access-lists", "show conn"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.16.169.118", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip traffic", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.2.124.127", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show ip ospf database"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.69.82.145", "event": "port scan detected", "severity": "low"}, "requested_show": ["show logging | include DENY", "show access-lists", "show conn", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.234.54.204", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show ip ospf database"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.255.84.101", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.106.90.81", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.195.28.121", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show run | include vty", "show users", "show access-lists"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.156.94.121", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip traffic", "show arp", "show mac address-table"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.92.70.123", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show ip verify source", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.72.74.17", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.240.183.248", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip route", "show ip bgp summary", "show logging | include BGP", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.199.60.20", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.45.92.90", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show memory statistics", "show platform resources", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.230.233.97", "event": "port scan detected", "severity": "low"}, "requested_show": ["show logging | include DENY", "show ip traffic", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.70.79.203", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show memory statistics", "show processes cpu sorted", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.94.188.193", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf database", "show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.113.254.104", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show access-lists", "show ip traffic", "show conn", "show logging | include DENY", "show firewall"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.163.166.156", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp neighbors", "show ip cef", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.130.135.29", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show mac address-table", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.90.123.43", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.121.128.142", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show memory statistics", "show platform resources", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.151.140.95", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.125.40.123", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.118.150.121", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip route", "show ip cef", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.178.224.34", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show interfaces counters errors", "show memory statistics", "show platform resources"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.84.222.236", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf database", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.168.54.248", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf neighbor", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.175.104.23", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.102.55.29", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip traffic", "show ip verify source", "show mac address-table"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.15.99.203", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp summary", "show ip route", "show logging | include BGP", "show ip cef"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.22.59.175", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show mac address-table", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.111.45.37", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp summary", "show ip cef", "show logging | include BGP", "show ip route", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.207.25.33", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show interfaces counters errors", "show platform resources", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.171.188.151", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show ip ssh", "show access-lists", "show ip interface brief", "show run | include vty", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.87.10.218", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.202.24.244", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.123.81.153", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.171.163.73", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show ip traffic", "show conn", "show firewall", "show access-lists"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.156.149.119", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show access-lists", "show users", "show ip ssh", "show logging | include SSH", "show ip interface brief", "show run | include vty"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.67.100.129", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.145.74.19", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show mac address-table", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.235.86.250", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show memory statistics", "show platform resources", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.132.19.188", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip traffic", "show ip verify source", "show mac address-table"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.127.214.66", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show mac address-table", "show arp", "show ip traffic", "show ip verify source"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.65.20.178", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.35.253.85", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show platform resources", "show interfaces counters errors", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.9.7.90", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.171.177.169", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf database", "show ip ospf interface", "show ip ospf neighbor", "show interfaces"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.67.13.65", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show run | include vty", "show access-lists", "show ip ssh", "show users", "show ip interface brief"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.233.215.154", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp neighbors", "show ip cef", "show ip bgp summary", "show ip route"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.207.52.56", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.98.122.211", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf database", "show ip ospf interface", "show ip ospf neighbor", "show interfaces"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.175.117.183", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp neighbors", "show ip cef", "show ip bgp summary", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.15.160.53", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show ip cef", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.15.160.250", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip cef", "show ip route", "show logging | include BGP", "show ip bgp neighbors", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.41.38.56", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show ip traffic", "show mac address-table", "show ip verify source"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.139.238.55", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip traffic", "show ip verify source", "show mac address-table"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.165.179.81", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show users", "show ip interface brief", "show access-lists", "show ip ssh", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.52.19.234", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.240.81.56", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show arp", "show mac address-table", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.51.198.29", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show memory statistics", "show platform resources"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.99.194.168", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.149.110.144", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show platform resources", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.77.109.109", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show mac address-table", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.77.225.147", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.136.242.240", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.236.23.159", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show logging | include BGP", "show ip route", "show ip cef"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.132.160.141", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show logging | include SSH", "show users", "show access-lists", "show run | include vty", "show ip ssh"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.22.215.205", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show logging | include DENY", "show ip traffic"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.46.109.162", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging | include SSH", "show users", "show ip ssh", "show ip interface brief", "show access-lists"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.16.92.173", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging | include SSH", "show access-lists", "show users", "show run | include vty", "show ip ssh", "show ip interface brief"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.24.57.235", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show platform resources", "show processes cpu sorted", "show memory statistics"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.26.211.30", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show interfaces", "show ip ospf database", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.234.72.215", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp summary", "show logging | include BGP", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.71.131.166", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show users", "show logging | include SSH", "show ip interface brief", "show access-lists", "show run | include vty", "show ip ssh"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.33.90.156", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show arp", "show ip verify source", "show ip traffic", "show mac address-table"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.51.176.36", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.247.137.26", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.17.1.83", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip verify source", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.221.115.238", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show interfaces counters errors", "show memory statistics"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.3.224.26", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip traffic", "show arp", "show mac address-table", "show ip verify source"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.95.223.217", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show mac address-table", "show ip traffic", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.90.19.19", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf interface", "show ip ospf database"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.211.194.42", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show platform resources", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.70.115.150", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic", "show ip verify source"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.205.218.17", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf database", "show ip ospf interface", "show interfaces", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.250.194.143", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show ip ssh", "show run | include vty", "show users", "show access-lists"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.92.90.180", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip traffic", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.172.197.206", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf interface", "show ip ospf database", "show interfaces"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.243.99.243", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf database", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.87.16.227", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show access-lists", "show users", "show ip interface brief", "show run | include vty", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.178.209.97", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.128.198.120", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show users", "show logging | include SSH", "show access-lists"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.41.42.254", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.131.229.230", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show logging | include DENY", "show conn", "show ip traffic", "show firewall", "show access-lists"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.245.152.218", "event": "port scan detected", "severity": "high"}, "requested_show": ["show logging | include DENY", "show conn", "show access-lists"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.119.204.181", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show interfaces", "show ip ospf database", "show ip ospf interface", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.81.38.124", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show access-lists", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.151.119.43", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show access-lists", "show ip interface brief", "show run | include vty"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.39.140.230", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.56.63.116", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip traffic", "show arp", "show mac address-table"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.174.55.21", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show mac address-table", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.228.79.59", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp summary", "show ip cef", "show ip route"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.71.108.154", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf database", "show ip ospf neighbor", "show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.10.219.75", "event": "port scan detected", "severity": "high"}, "requested_show": ["show access-lists", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.248.161.67", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show ip ospf database", "show interfaces"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.126.59.162", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.115.3.66", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf interface", "show ip ospf database", "show interfaces", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.43.90.227", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show platform resources", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.211.117.163", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show ip traffic", "show access-lists", "show firewall", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.123.238.175", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.222.121.194", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf database", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.3.129.41", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show interfaces counters errors", "show platform resources", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.83.63.146", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show ip ssh", "show logging | include SSH", "show run | include vty", "show users", "show ip interface brief", "show access-lists"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.61.98.68", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show interfaces counters errors", "show processes cpu sorted", "show memory statistics", "show platform resources"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.154.181.198", "event": "port scan detected", "severity": "high"}, "requested_show": ["show logging | include DENY", "show access-lists", "show firewall", "show ip traffic", "show conn"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.154.73.117", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show memory statistics", "show processes cpu sorted", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.188.9.104", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.229.245.173", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.4.236.158", "event": "port scan detected", "severity": "high"}, "requested_show": ["show firewall", "show access-lists", "show logging | include DENY", "show conn"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.7.128.251", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show access-lists", "show ip ssh", "show run | include vty", "show ip interface brief", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.174.192.75", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp neighbors", "show ip cef", "show ip bgp summary", "show ip route", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.211.184.120", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp summary", "show ip cef", "show ip bgp neighbors", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.238.240.208", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp summary", "show ip cef", "show logging | include BGP", "show ip bgp neighbors", "show ip route"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.28.119.212", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show memory statistics", "show platform resources", "show processes cpu sorted", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.144.25.160", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.171.202.29", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show users", "show ip interface brief", "show logging | include SSH", "show run | include vty", "show ip ssh", "show access-lists"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.112.67.151", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show mac address-table", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.174.56.62", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show memory statistics", "show platform resources", "show interfaces counters errors", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.157.124.107", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic", "show ip verify source"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.187.120.237", "event": "port scan detected", "severity": "high"}, "requested_show": ["show firewall", "show conn", "show access-lists", "show logging | include DENY", "show ip traffic"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.39.253.245", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show access-lists", "show ip interface brief", "show run | include vty", "show ip ssh"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.3.31.212", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip ssh", "show users", "show logging | include SSH", "show access-lists", "show ip interface brief", "show run | include vty"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.213.9.97", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show access-lists", "show firewall", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.104.214.87", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip route", "show ip bgp summary", "show ip bgp neighbors", "show ip cef"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.114.240.121", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show memory statistics", "show processes cpu sorted", "show platform resources"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.49.178.144", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show users", "show access-lists", "show ip ssh", "show ip interface brief"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.165.14.141", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.181.40.29", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show mac address-table", "show ip traffic", "show ip verify source"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.118.87.205", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show mac address-table", "show ip traffic", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.163.160.53", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp neighbors", "show ip cef", "show logging | include BGP", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.82.139.77", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show ip ssh", "show access-lists", "show logging | include SSH", "show users", "show ip interface brief", "show run | include vty"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.167.25.196", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp neighbors", "show logging | include BGP", "show ip cef", "show ip route"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.39.216.11", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show run | include vty", "show users", "show access-lists", "show logging | include SSH", "show ip ssh"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.76.42.64", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show access-lists", "show logging | include SSH", "show ip interface brief", "show run | include vty"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.20.21.191", "event": "port scan detected", "severity": "low"}, "requested_show": ["show access-lists", "show firewall", "show conn", "show ip traffic"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.212.108.95", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show logging | include SSH", "show run | include vty", "show users", "show access-lists", "show ip interface brief", "show ip ssh"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.172.255.219", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show access-lists", "show ip traffic", "show logging | include DENY", "show firewall", "show conn"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.229.6.168", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.33.43.144", "event": "port scan detected", "severity": "low"}, "requested_show": ["show conn", "show ip traffic", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.216.249.188", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show processes cpu sorted", "show interfaces counters errors", "show platform resources"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.240.16.113", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.99.204.226", "event": "port scan detected", "severity": "low"}, "requested_show": ["show logging | include DENY", "show access-lists", "show ip traffic", "show conn", "show firewall"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.31.208.160", "event": "port scan detected", "severity": "high"}, "requested_show": ["show ip traffic", "show firewall", "show conn"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.167.32.47", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip traffic", "show mac address-table", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.36.10.168", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.190.112.29", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show platform resources", "show processes cpu sorted", "show interfaces counters errors", "show memory statistics"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.55.185.104", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show platform resources"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.38.95.51", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.146.131.100", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show mac address-table", "show ip verify source"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.87.18.137", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show run | include vty", "show users", "show logging | include SSH", "show ip interface brief"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.98.6.214", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip verify source", "show ip traffic", "show mac address-table"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.144.203.151", "event": "port scan detected", "severity": "high"}, "requested_show": ["show logging | include DENY", "show firewall", "show conn"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.175.138.227", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf interface", "show ip ospf database"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.207.52.137", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic", "show ip verify source"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.172.61.173", "event": "port scan detected", "severity": "low"}, "requested_show": ["show ip traffic", "show access-lists", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.89.138.95", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.43.116.181", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show users", "show logging | include SSH", "show ip interface brief", "show run | include vty", "show access-lists", "show ip ssh"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.76.22.72", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip cef", "show ip bgp neighbors", "show logging | include BGP", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.113.232.169", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show interfaces counters errors", "show platform resources"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.187.126.149", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf database"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.174.165.235", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show run | include vty", "show users", "show access-lists", "show ip ssh", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.188.183.139", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show interfaces", "show ip ospf neighbor", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.187.30.180", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show interfaces counters errors", "show platform resources"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.192.245.141", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show ip ospf database", "show interfaces"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.211.69.34", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show logging | include BGP", "show ip bgp neighbors", "show ip cef", "show ip bgp summary", "show ip route"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.173.135.37", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.73.87.83", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging | include SSH", "show ip ssh", "show users", "show ip interface brief", "show access-lists"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.118.171.158", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.11.81.4", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show interfaces counters errors", "show processes cpu sorted", "show platform resources"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.168.213.253", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.11.143.207", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show run | include vty", "show ip interface brief", "show ip ssh", "show users", "show access-lists"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.111.78.186", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf database", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.220.38.39", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip ssh", "show logging | include SSH", "show users", "show access-lists", "show run | include vty"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.106.2.100", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show run | include vty", "show logging | include SSH", "show ip ssh", "show users"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.63.118.60", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show access-lists", "show ip traffic", "show logging | include DENY", "show firewall"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.174.88.110", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show logging | include BGP", "show ip route", "show ip bgp summary", "show ip cef"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.196.15.136", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.32.206.127", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show firewall", "show logging | include DENY", "show access-lists", "show conn", "show ip traffic"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.110.72.158", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show access-lists", "show conn", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.66.67.107", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.6.154.216", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show memory statistics", "show interfaces counters errors", "show platform resources", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.251.97.215", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show ip ssh", "show run | include vty", "show access-lists", "show users", "show logging | include SSH", "show ip interface brief"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.110.131.28", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp summary", "show ip route", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.128.19.176", "event": "port scan detected", "severity": "low"}, "requested_show": ["show conn", "show logging | include DENY", "show access-lists"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.30.63.4", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.82.136.160", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.113.202.225", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip cef", "show ip bgp summary", "show ip route"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.127.27.202", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show platform resources", "show interfaces counters errors", "show processes cpu sorted", "show memory statistics"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.183.165.57", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.71.6.176", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show run | include vty", "show logging | include SSH", "show ip interface brief", "show access-lists"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.19.2.205", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show ip traffic", "show logging | include DENY", "show firewall"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.96.237.228", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show mac address-table", "show arp", "show ip traffic"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.42.135.217", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp neighbors", "show ip route", "show ip cef", "show ip bgp summary", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.16.36.141", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show interfaces", "show ip ospf database", "show ip ospf neighbor", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.178.128.243", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show platform resources", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.214.222.242", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip verify source", "show mac address-table", "show arp", "show ip traffic"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.170.58.178", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.186.70.134", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.148.175.36", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show run | include vty", "show ip ssh", "show ip interface brief", "show access-lists"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.29.66.236", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show access-lists", "show conn", "show logging | include DENY", "show ip traffic", "show firewall"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.2.157.19", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show interfaces counters errors", "show platform resources"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.37.240.189", "event": "port scan detected", "severity": "low"}, "requested_show": ["show ip traffic", "show conn", "show firewall"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.218.162.44", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show ip verify source", "show mac address-table"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.155.215.28", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show ip ssh", "show run | include vty", "show logging | include SSH", "show users", "show access-lists", "show ip interface brief"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.182.164.171", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show arp", "show ip verify source", "show mac address-table"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.88.238.200", "event": "port scan detected", "severity": "low"}, "requested_show": ["show access-lists", "show firewall", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.3.192.150", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show logging | include DENY", "show firewall", "show conn", "show access-lists"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.248.136.35", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.247.234.28", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show processes cpu sorted", "show interfaces counters errors", "show memory statistics", "show platform resources"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.112.122.167", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.212.211.191", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show ip ssh", "show users", "show ip interface brief", "show run | include vty", "show access-lists", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.114.189.50", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show interfaces", "show ip ospf neighbor", "show ip ospf interface", "show ip ospf database"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.250.77.92", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp summary", "show ip cef", "show logging | include BGP", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.45.194.49", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf database", "show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.89.150.198", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip cef", "show ip bgp summary", "show ip route"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.105.34.80", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip cef", "show logging | include BGP", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.156.45.228", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.83.195.90", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip ssh", "show ip interface brief", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.177.29.21", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show access-lists", "show ip traffic", "show logging | include DENY", "show firewall"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.105.226.87", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show access-lists", "show logging | include DENY", "show firewall"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.57.70.69", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.42.29.195", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.246.225.79", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show interfaces counters errors", "show processes cpu sorted", "show memory statistics", "show platform resources"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.16.84.131", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.28.41.118", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show ip ssh", "show run | include vty", "show logging | include SSH", "show users", "show access-lists"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.112.249.226", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show interfaces", "show ip ospf database", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.169.151.37", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show platform resources", "show processes cpu sorted", "show memory statistics", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.46.22.50", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show access-lists", "show users", "show ip ssh", "show logging | include SSH", "show ip interface brief", "show run | include vty"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.90.146.126", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show mac address-table", "show arp", "show ip traffic"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.91.77.120", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show logging | include BGP", "show ip cef", "show ip bgp summary", "show ip route"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.166.253.232", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip traffic", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.19.121.158", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show users", "show run | include vty", "show access-lists"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.75.51.199", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip route", "show ip bgp summary", "show ip cef", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.162.217.11", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip verify source", "show mac address-table", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.52.22.244", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show mac address-table", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.12.73.121", "event": "port scan detected", "severity": "low"}, "requested_show": ["show access-lists", "show logging | include DENY", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.245.217.169", "event": "port scan detected", "severity": "high"}, "requested_show": ["show firewall", "show logging | include DENY", "show access-lists", "show conn"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.14.176.110", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf database", "show interfaces", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.6.229.183", "event": "port scan detected", "severity": "high"}, "requested_show": ["show ip traffic", "show firewall", "show logging | include DENY", "show conn"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.180.15.252", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip verify source", "show arp", "show ip traffic"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.210.180.142", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip verify source", "show arp", "show mac address-table"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.136.202.76", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip verify source", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.14.49.5", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show logging | include DENY", "show access-lists", "show firewall", "show conn"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.243.155.61", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.43.21.91", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show access-lists", "show run | include vty", "show users", "show ip ssh"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.95.35.16", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show logging | include BGP", "show ip cef", "show ip bgp neighbors", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.21.114.207", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp neighbors", "show ip cef", "show ip bgp summary", "show ip route"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.195.139.224", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.89.111.44", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show access-lists", "show users", "show ip interface brief", "show ip ssh", "show logging | include SSH", "show run | include vty"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.129.43.169", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show interfaces counters errors", "show processes cpu sorted", "show platform resources"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.52.32.219", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf database", "show ip ospf interface", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.17.246.113", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip traffic", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.48.224.50", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show interfaces counters errors", "show memory statistics", "show processes cpu sorted", "show platform resources"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.51.176.17", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show access-lists", "show ip ssh", "show ip interface brief", "show users"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.166.234.98", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.220.66.61", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show mac address-table", "show ip traffic", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.243.160.96", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf database", "show ip ospf interface", "show interfaces", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.177.103.234", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show mac address-table", "show ip verify source", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.32.230.119", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp neighbors", "show logging | include BGP", "show ip cef"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.88.100.52", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.211.190.215", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp summary", "show ip cef", "show ip bgp neighbors", "show logging | include BGP", "show ip route"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.119.189.100", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show processes cpu sorted", "show platform resources"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.132.179.61", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show users", "show logging | include SSH", "show ip interface brief", "show run | include vty"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.35.179.166", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp neighbors", "show ip route", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.209.15.92", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show platform resources", "show memory statistics", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.191.19.32", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show interfaces counters errors", "show memory statistics"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.249.155.124", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show ip traffic", "show logging | include DENY", "show firewall", "show conn"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.167.188.107", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip traffic", "show ip verify source", "show mac address-table"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.225.73.34", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip verify source", "show arp", "show ip traffic", "show mac address-table"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.142.174.196", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.75.196.133", "event": "port scan detected", "severity": "high"}, "requested_show": ["show logging | include DENY", "show conn", "show access-lists", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.32.57.33", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show platform resources", "show processes cpu sorted", "show memory statistics", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.166.86.196", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp neighbors", "show logging | include BGP", "show ip route", "show ip cef"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.112.40.222", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip interface brief", "show users", "show access-lists", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.37.237.26", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show interfaces counters errors", "show memory statistics"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.191.144.213", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show arp", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.94.113.86", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show mac address-table", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.31.4.140", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp summary", "show ip route", "show ip cef", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.172.254.31", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show arp", "show ip traffic", "show mac address-table"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.248.9.135", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show memory statistics", "show processes cpu sorted", "show interfaces counters errors", "show platform resources"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.33.102.35", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show platform resources", "show interfaces counters errors", "show processes cpu sorted", "show memory statistics"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.6.132.29", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.24.34.52", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show ip traffic", "show mac address-table"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.104.29.248", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show platform resources", "show memory statistics", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.20.248.170", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show logging | include BGP", "show ip route", "show ip bgp neighbors", "show ip cef", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.172.148.114", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show run | include vty", "show ip ssh", "show ip interface brief", "show users", "show access-lists", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.133.63.52", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show interfaces counters errors", "show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.246.134.235", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show logging | include SSH", "show users", "show ip ssh", "show run | include vty", "show ip interface brief", "show access-lists"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.157.99.19", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.252.147.9", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show logging | include SSH", "show users", "show access-lists", "show ip ssh", "show run | include vty", "show ip interface brief"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.70.65.183", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show platform resources", "show interfaces counters errors", "show memory statistics"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.131.185.175", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip cef", "show logging | include BGP", "show ip route"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.46.130.119", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show firewall", "show logging | include DENY", "show ip traffic", "show access-lists"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.206.157.104", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip traffic", "show ip verify source", "show mac address-table", "show arp"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.182.246.163", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.47.156.228", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show logging | include BGP", "show ip route", "show ip bgp neighbors", "show ip bgp summary", "show ip cef"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.221.217.17", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.219.1.177", "event": "port scan detected", "severity": "low"}, "requested_show": ["show logging | include DENY", "show firewall", "show access-lists", "show conn", "show ip traffic"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.113.249.102", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show mac address-table", "show ip verify source"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.174.87.51", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show run | include vty", "show users", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.195.36.41", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.244.61.78", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf neighbor", "show ip ospf database", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.165.4.89", "event": "port scan detected", "severity": "low"}, "requested_show": ["show firewall", "show ip traffic", "show conn", "show access-lists", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.58.88.209", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip route", "show ip bgp neighbors", "show ip cef"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.51.84.219", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show memory statistics", "show platform resources", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.163.234.34", "event": "port scan detected", "severity": "low"}, "requested_show": ["show logging | include DENY", "show access-lists", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.224.40.5", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.38.108.232", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip route", "show ip bgp neighbors", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.42.60.73", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.189.92.233", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show mac address-table", "show arp", "show ip traffic", "show ip verify source"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.210.32.30", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip traffic", "show ip verify source", "show mac address-table", "show arp"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.34.21.100", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show users", "show ip interface brief", "show logging | include SSH", "show ip ssh", "show run | include vty"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.13.158.140", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic", "show ip verify source"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.135.205.5", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show interfaces"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.20.236.168", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show interfaces", "show ip ospf database", "show ip ospf interface", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.196.10.161", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show memory statistics", "show platform resources", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.105.102.126", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic", "show ip verify source"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.5.93.217", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show memory statistics", "show interfaces counters errors", "show platform resources"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.110.133.40", "event": "port scan detected", "severity": "low"}, "requested_show": ["show logging | include DENY", "show access-lists", "show conn", "show ip traffic"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.103.105.183", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.53.233.2", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp neighbors", "show logging | include BGP", "show ip bgp summary", "show ip cef"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.232.184.47", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show ip ospf database", "show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.112.187.14", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show arp", "show ip traffic", "show ip verify source", "show mac address-table"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.158.82.222", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show memory statistics", "show processes cpu sorted", "show platform resources", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.63.77.166", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip verify source", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.133.147.148", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.183.26.49", "event": "port scan detected", "severity": "high"}, "requested_show": ["show firewall", "show conn", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.18.249.152", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip interface brief", "show ip ssh", "show access-lists"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.133.145.8", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show logging | include DENY", "show ip traffic", "show firewall", "show access-lists"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.35.210.19", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.88.148.97", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show logging | include BGP", "show ip route", "show ip cef"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.97.95.157", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show ip interface brief", "show logging | include SSH", "show ip ssh", "show users"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.194.150.105", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip ssh", "show run | include vty", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.132.99.176", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show logging | include SSH", "show run | include vty", "show ip ssh", "show ip interface brief", "show users"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.90.141.44", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic", "show ip verify source"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.140.51.126", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.20.163.101", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip ssh", "show logging | include SSH", "show access-lists", "show ip interface brief"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.162.233.166", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.171.129.45", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf interface", "show ip ospf database", "show ip ospf neighbor", "show interfaces"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.35.218.214", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show ip ospf database", "show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.162.43.132", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.233.203.144", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show ip ssh", "show access-lists", "show ip interface brief"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.58.188.175", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip cef", "show ip bgp summary", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.90.251.58", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip verify source", "show mac address-table", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.112.56.135", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show users", "show run | include vty", "show ip ssh"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.233.2.217", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.134.26.47", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show mac address-table", "show arp", "show ip traffic"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.106.47.53", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf interface", "show ip ospf database"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.253.239.25", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.125.31.164", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip verify source", "show ip traffic", "show mac address-table"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.35.120.22", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip interface brief", "show access-lists", "show run | include vty"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.131.184.160", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip ssh", "show logging | include SSH", "show access-lists", "show users"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.205.83.17", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show arp", "show ip verify source", "show ip traffic", "show mac address-table"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.187.226.155", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip interface brief", "show ip ssh", "show run | include vty", "show access-lists", "show logging | include SSH", "show users"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.7.88.134", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show arp", "show mac address-table", "show ip verify source"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.118.53.118", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.147.239.247", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show interfaces counters errors", "show processes cpu sorted", "show memory statistics", "show platform resources"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.17.117.82", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf interface", "show ip ospf database"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.46.13.146", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp neighbors", "show ip bgp summary", "show ip route", "show ip cef", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.71.78.111", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip traffic", "show ip verify source", "show mac address-table"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.196.21.193", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show interfaces counters errors", "show platform resources", "show processes cpu sorted", "show memory statistics"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.217.29.218", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show mac address-table", "show arp", "show ip traffic"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.54.243.194", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip interface brief", "show users", "show logging | include SSH", "show ip ssh"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.149.154.216", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip route", "show ip bgp neighbors", "show ip cef", "show logging | include BGP", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.157.214.128", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip route", "show ip bgp summary", "show ip cef"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.169.22.109", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.214.70.149", "event": "port scan detected", "severity": "low"}, "requested_show": ["show firewall", "show logging | include DENY", "show ip traffic", "show conn"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.11.123.96", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.96.84.19", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip route", "show ip bgp summary", "show ip cef", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.218.98.178", "event": "port scan detected", "severity": "high"}, "requested_show": ["show firewall", "show ip traffic", "show logging | include DENY", "show conn"]}
{"instruction": "Wazuh detected 'ssh brute-force' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.40.137.52", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show access-lists", "show ip ssh", "show ip interface brief"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.5.219.148", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.155.209.13", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show mac address-table", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.85.142.236", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show mac address-table", "show arp", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.10.253.126", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show access-lists", "show ip interface brief", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.173.65.186", "event": "port scan detected", "severity": "low"}, "requested_show": ["show conn", "show ip traffic", "show access-lists", "show logging | include DENY", "show firewall"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.198.11.21", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip traffic", "show mac address-table", "show ip verify source"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.162.35.200", "event": "port scan detected", "severity": "high"}, "requested_show": ["show access-lists", "show ip traffic", "show logging | include DENY", "show firewall"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.8.116.119", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf neighbor", "show ip ospf database", "show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.132.210.38", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show users", "show run | include vty", "show ip ssh"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.167.120.100", "event": "port scan detected", "severity": "high"}, "requested_show": ["show conn", "show logging | include DENY", "show ip traffic", "show access-lists"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.203.113.87", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.25.219.8", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.105.194.64", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show mac address-table", "show arp", "show ip traffic", "show ip verify source"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.220.11.50", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show ip ospf database", "show interfaces"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.99.154.32", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show platform resources", "show memory statistics", "show interfaces counters errors", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.208.34.95", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.64.76.24", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.0.125.223", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.255.121.177", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show ip traffic", "show ip verify source", "show mac address-table"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.73.140.3", "event": "port scan detected", "severity": "low"}, "requested_show": ["show firewall", "show conn", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.183.190.161", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip traffic", "show arp", "show mac address-table", "show ip verify source"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.110.220.185", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show memory statistics", "show platform resources", "show processes cpu sorted", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.76.94.191", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show ip ssh", "show run | include vty", "show logging | include SSH", "show access-lists", "show users"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.14.154.141", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf neighbor", "show ip ospf database", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.0.42.242", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip route", "show ip bgp summary", "show ip bgp neighbors", "show ip cef"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.103.181.78", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.111.147.201", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip interface brief", "show logging | include SSH", "show run | include vty", "show users", "show access-lists"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.245.155.20", "event": "port scan detected", "severity": "low"}, "requested_show": ["show conn", "show ip traffic", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.114.41.194", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp neighbors", "show ip route", "show ip cef"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.202.56.218", "event": "port scan detected", "severity": "high"}, "requested_show": ["show ip traffic", "show conn", "show firewall"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.95.239.41", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show interfaces counters errors", "show platform resources", "show processes cpu sorted", "show memory statistics"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.180.72.22", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf database", "show interfaces", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.167.196.76", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf interface", "show ip ospf database", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.65.94.141", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip ssh", "show logging | include SSH", "show users", "show access-lists", "show run | include vty", "show ip interface brief"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.88.5.65", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show users", "show access-lists", "show ip interface brief", "show logging | include SSH", "show run | include vty"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.118.140.88", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.225.88.242", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show memory statistics", "show platform resources"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.144.80.158", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf database", "show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.26.225.155", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.141.74.2", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show memory statistics", "show platform resources", "show interfaces counters errors", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.80.193.99", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.58.90.180", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.111.224.216", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf database", "show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.177.179.93", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show run | include vty", "show users", "show ip interface brief", "show ip ssh", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.179.2.237", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show platform resources", "show processes cpu sorted", "show memory statistics"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.126.133.124", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show interfaces counters errors", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.117.250.47", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show arp", "show ip traffic", "show ip verify source", "show mac address-table"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.205.116.127", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip cef", "show ip route", "show ip bgp summary", "show ip bgp neighbors", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.140.171.62", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show logging | include BGP", "show ip bgp neighbors", "show ip bgp summary", "show ip route", "show ip cef"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.127.136.116", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show users", "show access-lists", "show ip interface brief", "show ip ssh"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.164.59.121", "event": "port scan detected", "severity": "low"}, "requested_show": ["show access-lists", "show firewall", "show conn"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.81.121.178", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip verify source", "show arp", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.163.179.24", "event": "port scan detected", "severity": "high"}, "requested_show": ["show logging | include DENY", "show access-lists", "show conn", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.204.104.178", "event": "port scan detected", "severity": "high"}, "requested_show": ["show conn", "show access-lists", "show logging | include DENY", "show ip traffic"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.162.109.82", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show interfaces", "show ip ospf neighbor", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.236.37.192", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show interfaces", "show ip ospf neighbor", "show ip ospf interface", "show ip ospf database"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.96.118.48", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show access-lists", "show logging | include DENY"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.9.142.195", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip cef", "show ip route", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.101.118.148", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show platform resources", "show memory statistics", "show interfaces counters errors", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.90.80.60", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip route", "show ip bgp summary", "show ip cef", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.44.215.160", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show ip ospf database", "show interfaces"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.220.94.23", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show ip traffic", "show firewall", "show logging | include DENY", "show access-lists", "show conn"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.204.56.181", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip cef", "show ip bgp neighbors", "show logging | include BGP", "show ip route", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'high cpu usage' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.204.151.237", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.207.81.188", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.142.125.86", "event": "port scan detected", "severity": "high"}, "requested_show": ["show ip traffic", "show logging | include DENY", "show firewall", "show conn"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.17.129.236", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.190.83.49", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show mac address-table", "show arp", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.117.223.63", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.77.15.21", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show interfaces", "show ip ospf neighbor", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.217.117.84", "event": "port scan detected", "severity": "high"}, "requested_show": ["show conn", "show ip traffic", "show logging | include DENY", "show firewall"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.188.91.180", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show mac address-table", "show arp", "show ip traffic", "show ip verify source"]}
{"instruction": "Wazuh detected 'high cpu usage' on BRANCH-RTR1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.39.90.176", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show platform resources", "show interfaces counters errors", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.96.181.61", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show mac address-table", "show ip traffic", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.231.150.146", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show logging | include DENY", "show firewall", "show conn", "show ip traffic", "show access-lists"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.153.58.21", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show mac address-table", "show arp", "show ip traffic", "show ip verify source"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.44.113.125", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.127.224.2", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.149.239.239", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf database", "show interfaces", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.134.85.80", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show platform resources", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'bgp session flap' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.226.17.76", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip cef", "show ip bgp neighbors", "show logging | include BGP", "show ip route", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.128.251.132", "event": "port scan detected", "severity": "low"}, "requested_show": ["show conn", "show logging | include DENY", "show firewall", "show access-lists"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.207.143.27", "event": "port scan detected", "severity": "low"}, "requested_show": ["show ip traffic", "show firewall", "show conn", "show logging | include DENY", "show access-lists"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.106.47.165", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.164.117.152", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show logging | include BGP", "show ip route", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.215.255.54", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show mac address-table", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.142.137.235", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip cef", "show logging | include BGP", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.114.116.124", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show interfaces counters errors", "show platform resources", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on CORE-R1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.208.147.117", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip verify source", "show arp", "show ip traffic", "show mac address-table"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.125.53.47", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected 'bgp session flap' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.64.38.235", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip cef", "show ip bgp summary", "show logging | include BGP", "show ip bgp neighbors", "show ip route"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.122.75.183", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip verify source", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.89.77.36", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip ssh", "show users", "show access-lists", "show ip interface brief", "show run | include vty"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW2 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.13.2.175", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show run | include vty", "show ip interface brief", "show ip ssh", "show access-lists", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW2 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.73.242.240", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show ip cef"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.125.33.158", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected 'port scan detected' on ACCESS-SW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.45.32.226", "event": "port scan detected", "severity": "low"}, "requested_show": ["show ip traffic", "show firewall", "show conn"]}
{"instruction": "Wazuh detected 'port scan detected' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.210.131.18", "event": "port scan detected", "severity": "high"}, "requested_show": ["show logging | include DENY", "show conn", "show access-lists", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.53.83.20", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show logging | include DENY", "show ip traffic", "show firewall", "show access-lists"]}
{"instruction": "Wazuh detected 'ssh brute-force' on CORE-R1 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.193.120.180", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show access-lists", "show ip ssh", "show users", "show logging | include SSH", "show run | include vty", "show ip interface brief"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.167.14.57", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.161.82.53", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf neighbor", "show ip ospf database", "show interfaces"]}
{"instruction": "Wazuh detected 'ssh brute-force' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.127.202.146", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip interface brief", "show users", "show ip ssh"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.238.194.93", "event": "port scan detected", "severity": "high"}, "requested_show": ["show firewall", "show access-lists", "show conn"]}
{"instruction": "Wazuh detected 'high cpu usage' on ACCESS-SW2 with severity 'medium'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.178.170.122", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show memory statistics", "show processes cpu sorted", "show platform resources", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.159.32.170", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show logging | include BGP", "show ip cef", "show ip bgp summary", "show ip route", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected 'bgp session flap' on ACCESS-SW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.246.218.246", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show logging | include BGP", "show ip route", "show ip bgp neighbors", "show ip bgp summary"]}
{"instruction": "Wazuh detected 'bgp session flap' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.223.45.194", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip cef", "show ip bgp neighbors", "show ip route", "show logging | include BGP"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.221.65.130", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf database", "show ip ospf neighbor", "show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected 'ospf neighbor down' on CORE-R1 with severity 'critical'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.85.109.97", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on ACCESS-SW2 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.223.122.98", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show mac address-table", "show arp", "show ip traffic"]}
{"instruction": "Wazuh detected 'ssh brute-force' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.111.10.9", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show access-lists", "show ip ssh", "show ip interface brief", "show run | include vty", "show logging | include SSH"]}
{"instruction": "Wazuh detected 'arp spoofing suspected' on BRANCH-RTR1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.34.122.4", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show mac address-table", "show ip verify source", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected 'high cpu usage' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.212.183.203", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show memory statistics", "show processes cpu sorted", "show interfaces counters errors"]}
{"instruction": "Wazuh detected 'port scan detected' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.118.41.208", "event": "port scan detected", "severity": "low"}, "requested_show": ["show logging | include DENY", "show ip traffic", "show conn"]}
{"instruction": "Wazuh detected 'port scan detected' on CORE-R1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.13.78.38", "event": "port scan detected", "severity": "high"}, "requested_show": ["show conn", "show logging | include DENY", "show firewall", "show access-lists"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'high'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.39.7.243", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected 'vpn tunnel down' on EDGE-FW1 with severity 'low'. Provide all necessary Cisco show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.68.31.102", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}