{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 120908}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 96170}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 129997}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 123016}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 97496}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 146122}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 116361}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 127090}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 62233}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 79281}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 122956}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 60571}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 186395}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 135399}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 194718}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 104781}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 149335}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 79799}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 152750}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 153817}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 193566}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 94558}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 52964}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 151614}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 188811}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 183856}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 71025}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 94166}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 99197}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 186920}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 147602}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 80738}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 151923}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 177378}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 143218}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 193469}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 88742}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 182840}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 122791}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 114814}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 192317}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 146874}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 195138}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 175476}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 123197}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 88131}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 84941}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 170761}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 126037}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 93491}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 50237}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 103653}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 54318}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 107563}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 109121}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 94913}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 127529}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 95122}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 81565}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 195148}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 133857}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 56501}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 161431}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 136206}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 176198}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 185981}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 134658}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 51607}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 108834}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 88679}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 68463}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 120214}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 175918}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 88712}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 116030}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 148633}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 189447}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 160316}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 104845}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 109477}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 143453}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 93356}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 180391}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 63135}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 168163}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 76379}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 115466}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 119841}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 190492}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 121194}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 52340}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 93342}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 80829}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 181092}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 180644}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 78667}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 127052}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 189417}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 79440}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 114157}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 139945}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 169193}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 156287}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 142098}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 73579}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 184515}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 76188}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 85577}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 78507}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 97968}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 118655}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 106297}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 110562}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 110142}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 110081}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 161628}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 192711}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 113649}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 92204}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 123833}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 71752}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 54048}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 55388}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 165521}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 156119}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 84243}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 139511}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 84557}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 77659}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 121694}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 143738}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 63973}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 196164}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 110460}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 188338}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 155287}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 116445}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 147267}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 159921}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 63811}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 122257}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 189200}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 79067}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 194155}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 181052}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 155861}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 175902}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 76683}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 126426}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 87205}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 50260}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 191366}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 158113}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 125975}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 167203}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 187995}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 147590}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 139248}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 197194}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 171446}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 101685}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 134709}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 55689}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 196666}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 111690}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 141504}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 114949}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 164404}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 106003}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 170296}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 182642}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 83568}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 78246}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 195757}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 193824}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 160311}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 70303}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 188453}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 66354}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 190072}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 81006}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 77534}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 140423}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 169078}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 190850}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 188127}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 50756}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 144963}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 181425}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 84051}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 70983}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 64953}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 62644}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 193174}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 138081}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 77114}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 164289}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 50403}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 138602}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 82902}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 107884}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 60490}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 137605}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 83665}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 146148}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 97531}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 148457}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 84683}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 85087}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 157012}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 190721}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 190075}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 179474}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 79070}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 96148}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 170166}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 147473}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 166799}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 104489}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 87071}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 114135}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 83721}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 192986}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 66501}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 113741}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 138686}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 150502}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 132371}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 137366}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 93352}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 77569}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 115830}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 199602}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 106920}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 72035}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 114165}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 175933}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 159728}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 93364}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 64205}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 159422}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 176518}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 135624}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 99526}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 129894}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 123172}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 196577}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 66883}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 181853}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 125643}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 136881}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 148104}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 107123}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 143097}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 96405}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 130764}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 121010}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 169636}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 161840}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 142563}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 134991}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 54421}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 186692}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 170830}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 106364}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 100488}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 107285}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 181717}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 191642}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 105207}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 63933}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 58229}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 122297}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 145717}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 193421}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 141122}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 161327}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 108270}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 122013}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 150350}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 106235}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 118064}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 69869}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 53985}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 75431}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 141441}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 164131}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 122542}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 50839}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 75657}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/3", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "conn_count": 136135}], "cli_fix": ["interface GigabitEthernet0/3", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 95394}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/0", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "conn_count": 143744}], "cli_fix": ["interface GigabitEthernet0/0", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 101518}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/2", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/2", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "203.0.113.10", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "203.0.113.10"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 67274}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 145962}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "198.51.100.20", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "198.51.100.20"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 83531}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "spoofed_source": "192.168.0.0 0.0.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/3", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/3", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 189323}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "CORE-R1", "severity": "high", "interface": "GigabitEthernet0/0", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "spoofed_source": "172.16.0.0 0.15.255.255"}], "cli_fix": ["interface GigabitEthernet0/0", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "nat_translation_failure", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NAT translation failure", "device": "EDGE-FW1", "severity": "high", "public_ip": "192.0.2.30", "description": "NAT translation table full or pool exhausted."}, "devices": [{"name": "EDGE-FW1", "nat_pool": "exhausted", "failed_ip": "192.0.2.30"}], "cli_fix": ["ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.50 netmask 255.255.255.0", "ip nat inside source list 10 pool PUBLIC_POOL overload"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/1", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "conn_count": 174087}], "cli_fix": ["interface GigabitEthernet0/1", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}
{"incident_type": "ip_spoofing_suspected", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "interface": "GigabitEthernet0/1", "description": "Packets with private source addresses detected on public-facing interface."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "spoofed_source": "10.0.0.0 0.255.255.255"}], "cli_fix": ["interface GigabitEthernet0/1", "ip verify unicast source reachable-via rx", "exit"]}
{"incident_type": "firewall_connection_exhaust", "instruction": "Analyze firewall/NAT incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Firewall connection table exhaustion", "device": "EDGE-FW1", "severity": "critical", "interface": "GigabitEthernet0/2", "description": "High number of concurrent sessions exhausting firewall resources."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "conn_count": 79708}], "cli_fix": ["interface GigabitEthernet0/2", "ip inspect tcp max-incomplete high 2000", "ip inspect tcp max-incomplete low 1500", "exit"]}