{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "172.16.10.88", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.30.33", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 99, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.30.33", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 30, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "10.0.30.33", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 99, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.20.77", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 10, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "conflict_ip": "10.0.20.77", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 99, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "conflict_ip": "10.0.20.77", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 20, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 30, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 20, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "conflict_ip": "10.0.20.77", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "192.168.10.12", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 40, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "conflict_ip": "192.168.10.12", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 20, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 99, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "conflict_ip": "192.168.10.12", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "172.16.10.88", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.10.55", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 30, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 30, "conflict_ip": "10.0.30.33", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 10, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "conflict_ip": "10.0.10.55", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 10, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "conflict_ip": "10.0.10.55", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 40, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "conflict_ip": "10.0.30.33", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 99, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 40, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 99, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "conflict_ip": "10.0.20.77", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.30.33", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.20.77", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 40, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "192.168.10.12", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 40, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "conflict_ip": "10.0.30.33", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.30.33", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 40, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "conflict_ip": "192.168.10.12", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 40, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "conflict_ip": "10.0.30.33", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.30.33", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 20, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "conflict_ip": "10.0.20.77", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "172.16.10.88", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "192.168.10.12", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 20, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "conflict_ip": "192.168.10.12", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 40, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 99, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "conflict_ip": "10.0.20.77", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 30, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 30, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 10, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 10, "conflict_ip": "172.16.10.88", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 30, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 40, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "conflict_ip": "172.16.10.88", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.20.77", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 20, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "conflict_ip": "10.0.30.33", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 20, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "conflict_ip": "10.0.20.77", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.10.55", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 10, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 10, "conflict_ip": "192.168.10.12", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.10.55", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.20.77", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 30, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "10.0.30.33", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.30.33", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "192.168.10.12", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 40, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "conflict_ip": "10.0.20.77", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 99, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 10, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "conflict_ip": "192.168.10.12", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 99, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 40, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "conflict_ip": "10.0.10.55", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.30.33", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 10, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "conflict_ip": "10.0.30.33", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.10.55", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 20, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "conflict_ip": "192.168.10.12", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 20, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "conflict_ip": "10.0.30.33", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "192.168.10.12", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.20.77", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.20.77", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 10, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.10.55", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 30, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "conflict_ip": "10.0.10.55", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.20.77", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 20, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "conflict_ip": "192.168.10.12", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 40, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 40, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.20.77", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 20, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "conflict_ip": "10.0.30.33", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "172.16.10.88", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 10, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "conflict_ip": "10.0.30.33", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.20.77", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "192.168.10.12", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.20.77", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.30.33", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.10.55", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 99, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "conflict_ip": "10.0.20.77", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.20.77", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 30, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "conflict_ip": "10.0.30.33", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "192.168.10.12", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.10.55", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.30.33", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.10.55", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.20.77", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "192.168.10.12", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 40, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "conflict_ip": "10.0.20.77", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.10.55", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.20.77", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.10.55", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 30, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "10.0.20.77", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "192.168.10.12", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.20.77", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.30.33", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 30, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "10.0.10.55", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.10.55", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.10.55", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "172.16.10.88", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 99, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "conflict_ip": "10.0.30.33", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.20.77", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 40, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "conflict_ip": "10.0.20.77", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 40, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.10.55", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 10, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "conflict_ip": "172.16.10.88", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "172.16.10.88", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 10, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "conflict_ip": "192.168.10.12", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 30, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "10.0.10.55", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 40, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "conflict_ip": "10.0.20.77", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 30, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "conflict_ip": "192.168.10.12", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "192.168.10.12", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 99, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "conflict_ip": "192.168.10.12", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 30, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "192.168.10.12", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 10, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "conflict_ip": "192.168.10.12", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.30.33", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.30.33", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 99, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "conflict_ip": "10.0.30.33", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 20, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.20.77", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.10.55", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.20.77", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.30.33", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 10, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "conflict_ip": "172.16.10.88", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.10.55", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.20.77", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.20.77", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "192.168.10.12", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.30.33", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 30, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "conflict_ip": "10.0.30.33", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "192.168.10.12", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 10, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "conflict_ip": "192.168.10.12", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 30, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "192.168.10.12", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "192.168.10.12", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 40, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "conflict_ip": "192.168.10.12", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "172.16.10.88", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 30, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 30, "conflict_ip": "10.0.10.55", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.30.33", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 40, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "conflict_ip": "10.0.30.33", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 20, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "conflict_ip": "10.0.10.55", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 30, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "10.0.30.33", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 30, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.20.77", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 20, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "conflict_ip": "172.16.10.88", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "192.168.10.12", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 40, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "192.168.10.12", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "172.16.10.88", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 30, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "10.0.20.77", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 40, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "conflict_ip": "192.168.10.12", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 40, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "conflict_ip": "192.168.10.12", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 40, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 99, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 40, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "conflict_ip": "172.16.10.88", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 30, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "10.0.20.77", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "192.168.10.12", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 40, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "conflict_ip": "10.0.20.77", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 40, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "conflict_ip": "192.168.10.12", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "172.16.10.88", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 99, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "conflict_ip": "10.0.30.33", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 30, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "conflict_ip": "10.0.20.77", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 40, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "conflict_ip": "10.0.20.77", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 99, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "conflict_ip": "172.16.10.88", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 30, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "conflict_ip": "192.168.10.12", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "192.168.10.12", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 20, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "conflict_ip": "10.0.10.55", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 20, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "conflict_ip": "172.16.10.88", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 10, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 10, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 20, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 20, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "conflict_ip": "10.0.20.77", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "192.168.10.12", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 10, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 10, "conflict_ip": "10.0.20.77", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.30.33", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.30.33", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.30.33", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 40, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "conflict_ip": "10.0.30.33", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 40, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "conflict_ip": "10.0.30.33", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 20, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 99, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "172.16.10.88", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 30, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "10.0.20.77", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 20, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "conflict_ip": "10.0.10.55", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 99, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.10.55", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 40, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "conflict_ip": "172.16.10.88", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 10, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 20, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "conflict_ip": "192.168.10.12", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.30.33", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 40, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "conflict_ip": "10.0.20.77", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 40, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "conflict_ip": "10.0.20.77", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.20.77", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.10.55", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.20.77", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.10.55", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 30, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "10.0.20.77", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 40, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "conflict_ip": "192.168.10.12", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "192.168.10.12", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "192.168.10.12", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 10, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "conflict_ip": "192.168.10.12", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 30, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 30, "conflict_ip": "192.168.10.12", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 40, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "conflict_ip": "192.168.10.12", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.30.33", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.10.55", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 99, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 99, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "conflict_ip": "10.0.10.55", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.10.55", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.30.33", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.30.33", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "192.168.10.12", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.10.55", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.30.33", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 40, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "conflict_ip": "192.168.10.12", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 30, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "10.0.20.77", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.20.77", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 40, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "conflict_ip": "10.0.20.77", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 10, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "conflict_ip": "10.0.10.55", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 99, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 99, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "conflict_ip": "10.0.20.77", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.30.33", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 20, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "conflict_ip": "192.168.10.12", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.20.77", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 99, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "conflict_ip": "10.0.20.77", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 30, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "conflict_ip": "10.0.20.77", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 30, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 99, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "conflict_ip": "172.16.10.88", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.10.55", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.30.33", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "192.168.10.12", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.10.55", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "172.16.10.88", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 30, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "conflict_ip": "10.0.10.55", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 99, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "conflict_ip": "10.0.20.77", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 40, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "conflict_ip": "10.0.20.77", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "192.168.10.12", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.20.77", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 10, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "conflict_ip": "192.168.10.12", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.10.55", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.20.77", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 40, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "conflict_ip": "172.16.10.88", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 10, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "conflict_ip": "172.16.10.88", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "192.168.10.12", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.30.33", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.10.55", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "192.168.10.12", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 30, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 40, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "conflict_ip": "10.0.20.77", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.30.33", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.10.55", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 20, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 10, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.30.33", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 99, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "192.168.10.12", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "192.168.10.12", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "172.16.10.88", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.10.55", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 30, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "conflict_ip": "10.0.20.77", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 30, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 20, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 99, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "conflict_ip": "172.16.10.88", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.30.33", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 20, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "conflict_ip": "10.0.20.77", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.30.33", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.30.33", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 10, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 10, "conflict_ip": "10.0.20.77", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 30, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "192.168.10.12", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 10, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "conflict_ip": "10.0.10.55", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "192.168.10.12", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 99, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "conflict_ip": "10.0.30.33", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 99, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "172.16.10.88", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "192.168.10.12", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "192.168.10.12", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.20.77", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "192.168.10.12", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.30.33", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "192.168.10.12", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 20, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "conflict_ip": "172.16.10.88", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 99, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "conflict_ip": "10.0.10.55", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.10.55", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 99, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "conflict_ip": "192.168.10.12", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 40, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "conflict_ip": "10.0.10.55", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.30.33", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 30, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "conflict_ip": "10.0.20.77", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 40, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "conflict_ip": "172.16.10.88", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 20, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.20.77", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "192.168.10.12", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 10, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "conflict_ip": "192.168.10.12", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "172.16.10.88", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.10.55", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "192.168.10.12", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 10, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "conflict_ip": "10.0.30.33", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 99, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "conflict_ip": "10.0.10.55", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 40, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "conflict_ip": "192.168.10.12", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.10.55", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 10, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "conflict_ip": "192.168.10.12", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 99, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "conflict_ip": "10.0.10.55", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 40, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "172.16.10.88", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 99, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "conflict_ip": "192.168.10.12", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.30.33", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.20.77", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.20.77", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 40, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.10.55", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 30, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "192.168.10.12", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "192.168.10.12", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "192.168.10.12", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.10.55", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.30.33", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 40, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "conflict_ip": "10.0.10.55", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 40, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.30.33", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.10.55", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "192.168.10.12", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 99, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "conflict_ip": "172.16.10.88", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 99, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "conflict_ip": "192.168.10.12", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 99, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "192.168.10.12", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "192.168.10.12", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.30.33", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 10, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "conflict_ip": "10.0.30.33", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.30.33", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.30.33", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.10.55", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 10, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 10, "conflict_ip": "10.0.30.33", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.20.77", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "192.168.10.12", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.30.33", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 99, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "conflict_ip": "10.0.20.77", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 10, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.10.55", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.10.55", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 30, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 40, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "conflict_ip": "192.168.10.12", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "192.168.10.12", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 10, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 40, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "conflict_ip": "10.0.20.77", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "172.16.10.88", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 20, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "conflict_ip": "10.0.10.55", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.30.33", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 40, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.30.33", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.20.77", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "192.168.10.12", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.20.77", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 30, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "10.0.30.33", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.20.77", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 30, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "172.16.10.88", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 99, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "conflict_ip": "10.0.20.77", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 40, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "conflict_ip": "172.16.10.88", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 40, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "conflict_ip": "10.0.20.77", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.20.77", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 20, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "conflict_ip": "10.0.20.77", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 10, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "conflict_ip": "192.168.10.12", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 20, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 10, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 10, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "192.168.10.12", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.10.55", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 20, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 30, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "10.0.20.77", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.30.33", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 30, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "192.168.10.12", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 99, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.10.55", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 40, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "conflict_ip": "10.0.20.77", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 30, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 30, "conflict_ip": "10.0.20.77", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.20.77", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.30.33", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 20, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "conflict_ip": "192.168.10.12", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 20, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "conflict_ip": "10.0.30.33", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "192.168.10.12", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "172.16.10.88", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "192.168.10.12", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.20.77", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.10.55", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 10, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "172.16.10.88", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 10, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 10, "conflict_ip": "10.0.20.77", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.20.77", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.20.77", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 10, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 10, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 30, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 10, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "conflict_ip": "10.0.30.33", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 10, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 10, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.30.33", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "192.168.10.12", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 99, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "conflict_ip": "10.0.20.77", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 20, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "conflict_ip": "192.168.10.12", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 10, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 20, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "conflict_ip": "10.0.30.33", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "192.168.10.12", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 20, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "conflict_ip": "10.0.20.77", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 10, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 10, "conflict_ip": "10.0.20.77", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "172.16.10.88", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 40, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 99, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "conflict_ip": "172.16.10.88", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "172.16.10.88", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 40, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "conflict_ip": "192.168.10.12", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 30, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "10.0.10.55", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 10, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 10, "conflict_ip": "192.168.10.12", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "172.16.10.88", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.20.77", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "192.168.10.12", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 20, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 40, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.30.33", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 10, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 10, "conflict_ip": "10.0.20.77", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 30, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "10.0.30.33", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 20, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "conflict_ip": "10.0.20.77", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.10.55", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.10.55", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.30.33", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 40, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "conflict_ip": "10.0.30.33", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 10, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "conflict_ip": "10.0.20.77", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 30, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 30, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.10.55", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 10, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 20, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "conflict_ip": "192.168.10.12", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.20.77", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 20, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "conflict_ip": "10.0.10.55", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.10.55", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.20.77", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 10, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "conflict_ip": "10.0.30.33", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 40, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "conflict_ip": "172.16.10.88", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "172.16.10.88", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "192.168.10.12", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.30.33", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 99, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 10, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 10, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 10, "conflict_ip": "172.16.10.88", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.30.33", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 99, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "conflict_ip": "10.0.20.77", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.10.55", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.30.33", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 40, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "conflict_ip": "172.16.10.88", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 40, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "conflict_ip": "192.168.10.12", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.20.77", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.20.77", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "10.0.30.33", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 20, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "conflict_ip": "10.0.30.33", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "192.168.10.12", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 99, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "conflict_ip": "10.0.20.77", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 40, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 99, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "conflict_ip": "10.0.10.55", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "192.168.10.12", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.20.77", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.10.55", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.10.55", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 40, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "conflict_ip": "10.0.30.33", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 20, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "conflict_ip": "10.0.30.33", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 99, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 20, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 40, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 40, "conflict_ip": "10.0.20.77", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 20, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 99, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "conflict_ip": "10.0.20.77", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.20.77", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "172.16.10.88", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.10.55", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 20, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "conflict_ip": "192.168.10.12", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "192.168.10.12", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 20, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 99, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "conflict_ip": "172.16.10.88", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 30, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "172.16.10.88", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 99, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "conflict_ip": "10.0.20.77", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "high", "ip": "10.0.30.33", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 20, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "conflict_ip": "192.168.10.12", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.20.77", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 99, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "conflict_ip": "10.0.20.77", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "pool_usage": "95%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "192.168.10.12", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 10, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "conflict_ip": "10.0.30.33", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.30.33", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 30, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "192.168.10.12", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 30, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 30, "conflict_ip": "172.16.10.88", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 10, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "conflict_ip": "10.0.20.77", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 10, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 30, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.10.55", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 30, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "conflict_ip": "10.0.10.55", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.20.77", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 20, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "conflict_ip": "10.0.10.55", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "high", "vlan": 20, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "conflict_ip": "10.0.20.77", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 99, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "conflict_ip": "10.0.10.55", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.20.77", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 10, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.10.55", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 40, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "conflict_ip": "172.16.10.88", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "EDGE-FW1", "severity": "medium", "ip": "172.16.10.88", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 30, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 30, "conflict_ip": "10.0.20.77", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.10.200", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "pool_usage": "99%", "top_source_ip": "10.0.10.200"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 10, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "conflict_ip": "10.0.10.55", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 99, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 99, "conflict_ip": "172.16.10.88", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 20, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 20, "conflict_ip": "10.0.30.33", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 20, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "MGMT_POOL", "vlan": 20, "conflict_ip": "10.0.10.55", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "192.168.10.12", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 40, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "conflict_ip": "192.168.10.12", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 30, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "conflict_ip": "192.168.10.12", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "172.16.10.88", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 40, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 99, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "conflict_ip": "10.0.30.33", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "pool_usage": "99%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "192.168.10.12", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 20, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "conflict_ip": "10.0.30.33", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "pool_usage": "99%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 99, "pool_usage": "95%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 40, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 40, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 40", "ip dhcp snooping", "ip dhcp snooping vlan 40"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 30, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN20_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 40, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "conflict_ip": "10.0.10.55", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN30_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "10.0.20.201"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "10.0.20.77", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "conflict_ip": "10.0.20.77", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 20, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 20, "conflict_ip": "192.168.10.12", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 30, "ip": "10.0.20.77", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "conflict_ip": "10.0.20.77", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 10.0.20.77 10.0.20.77", "clear ip dhcp conflict 10.0.20.77"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 40, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "conflict_ip": "10.0.30.33", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "medium", "ip": "10.0.30.33", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 20, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 40, "ip": "172.16.10.88", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "conflict_ip": "172.16.10.88", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 172.16.10.88 172.16.10.88", "clear ip dhcp conflict 172.16.10.88"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 30, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 30, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 30", "ip dhcp snooping", "ip dhcp snooping vlan 30"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 10, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "172.16.10.88", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "medium", "vlan": 99, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "conflict_ip": "192.168.10.12", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "CORE-R1", "severity": "high", "ip": "10.0.10.55", "vlan": 99, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "CORE-R1", "vlan": 99, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 99", "ip dhcp snooping", "ip dhcp snooping vlan 99"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "172.16.10.88", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "172.16.10.88", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN10_POOL", "vlan": 10, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 99, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN20_POOL", "vlan": 99, "conflict_ip": "192.168.10.12", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "high", "ip": "192.168.10.12", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "192.168.10.12", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 99, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "MGMT_POOL", "vlan": 99, "conflict_ip": "10.0.30.33", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 10, "pool_usage": "99%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 40, "pool_usage": "100%", "top_source_ip": "203.0.113.45"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.10.55", "vlan": 20, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "conflict_ip": "10.0.10.55", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 20", "ip dhcp snooping", "ip dhcp snooping vlan 20"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "high", "vlan": 30, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN10_POOL", "vlan": 30, "conflict_ip": "192.168.10.12", "client_mac": "00ff.eedd.ccbb"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 40, "pool_usage": "95%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_starvation", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP starvation suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "High rate of DHCPDISCOVER/DHCPREQUEST observed; pool utilization near 100%."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 30, "pool_usage": "100%", "top_source_ip": "198.51.100.77"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "interface GigabitEthernet0/1", "ip dhcp snooping trust", "exit", "interface GigabitEthernet0/2", "ip dhcp snooping limit rate 15", "exit"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "BRANCH-RTR1", "severity": "medium", "vlan": 20, "ip": "192.168.10.12", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "BRANCH-RTR1", "dhcp_pool": "VLAN30_POOL", "vlan": 20, "conflict_ip": "192.168.10.12", "client_mac": "00aa.bbcc.ddee"}], "cli_fix": ["ip dhcp excluded-address 192.168.10.12 192.168.10.12", "clear ip dhcp conflict 192.168.10.12"]}
{"incident_type": "ip_conflicts", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "IP conflict suspected", "device": "BRANCH-RTR1", "severity": "medium", "ip": "10.0.30.33", "vlan": 10, "description": "Duplicate IP detected on the network; ARP instability observed."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "conflict_ip": "10.0.30.33", "symptom": "ARP flapping / duplicate replies"}], "cli_fix": ["ip arp inspection vlan 10", "ip dhcp snooping", "ip dhcp snooping vlan 10"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 40, "ip": "10.0.10.55", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "GUEST_POOL", "vlan": 40, "conflict_ip": "10.0.10.55", "client_mac": "0011.2233.4455"}], "cli_fix": ["ip dhcp excluded-address 10.0.10.55 10.0.10.55", "clear ip dhcp conflict 10.0.10.55"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "CORE-R1", "severity": "high", "vlan": 20, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "CORE-R1", "dhcp_pool": "VLAN20_POOL", "vlan": 20, "conflict_ip": "10.0.30.33", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}
{"incident_type": "dhcp_conflict", "instruction": "Analyze DHCP/IP addressing incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DHCP conflict detected", "device": "EDGE-FW1", "severity": "medium", "vlan": 99, "ip": "10.0.30.33", "description": "DHCP server detected an IP address conflict; client cannot obtain lease."}, "devices": [{"name": "EDGE-FW1", "dhcp_pool": "GUEST_POOL", "vlan": 99, "conflict_ip": "10.0.30.33", "client_mac": "aabb.ccdd.eeff"}], "cli_fix": ["ip dhcp excluded-address 10.0.30.33 10.0.30.33", "clear ip dhcp conflict 10.0.30.33"]}