{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 10, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 20, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 10, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 20, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 20, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 10, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 20, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 20, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 10, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 10, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 10, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 10, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 20, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 20, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 10, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 20, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 10, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 10, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 10, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 10, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 20, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 10, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 20, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 10, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 20, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 10, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 10, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Vlan99"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 8.8.8.8"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 20, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 8.8.8.8"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "NXDOMAIN spike", "domain": "example.com", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "safe.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 10.0.1.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 20, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 1.1.1.1", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "example.com", "current_dns": ["1.1.1.1"]}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.1.53", "ip name-server 1.1.1.1"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 30, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "stratum 16", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 40, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 10, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "EDGE-FW1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "EDGE-FW1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 1.1.1.1", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 20, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 10.0.0.53", "ip name-server 8.8.8.8"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.1.53", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 40, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 40, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 40, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 40", "ip arp inspection vlan 40"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.0.20.201", "vlan": 20, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 20, "top_source_ip": "10.0.20.201", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 20", "ip arp inspection vlan 20"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "stratum 16", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["10.0.1.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 30, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "no association", "recommended_server": "10.0.1.123", "source_interface": "Vlan99"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Vlan99", "ntp update-calendar"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "198.51.100.77", "vlan": 30, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 30, "top_source_ip": "198.51.100.77", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 30", "ip arp inspection vlan 30"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "BRANCH-RTR1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 10, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "BRANCH-RTR1", "vlan": 10, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 10", "ip arp inspection vlan 10"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "CORE-R1", "severity": "high", "source_ip": "203.0.113.45", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "CORE-R1", "vlan": 99, "top_source_ip": "203.0.113.45", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "arp_spoofing", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "ARP spoofing suspected", "device": "EDGE-FW1", "severity": "high", "source_ip": "10.10.10.5", "vlan": 99, "description": "Multiple ARP replies for the same IP/MAC detected; possible ARP poisoning."}, "devices": [{"name": "EDGE-FW1", "vlan": 99, "top_source_ip": "10.10.10.5", "symptom": "duplicate ARP replies / MAC move"}], "cli_fix": ["ip dhcp snooping", "ip dhcp snooping vlan 99", "ip arp inspection vlan 99"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "example.com", "current_dns": []}], "cli_fix": ["ip domain-lookup", "ip domain-name example.com", "ip name-server 10.0.0.53", "ip name-server 1.1.1.1"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "CORE-R1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "CORE-R1", "ntp_state": "no association", "recommended_server": "10.0.0.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.0.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "BRANCH-RTR1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "BRANCH-RTR1", "symptom": "NXDOMAIN spike", "domain": "safe.local", "current_dns": ["10.0.0.53"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 10.0.0.53"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "medium", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "pool.ntp.org", "source_interface": "Loopback0"}], "cli_fix": ["ntp server pool.ntp.org", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "ntp_unsynchronize", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "NTP unsynchronized", "device": "BRANCH-RTR1", "severity": "high", "description": "NTP not synchronized; time drift exceeds threshold."}, "devices": [{"name": "BRANCH-RTR1", "ntp_state": "unsynced", "recommended_server": "10.0.1.123", "source_interface": "Loopback0"}], "cli_fix": ["ntp server 10.0.1.123", "ntp source Loopback0", "ntp update-calendar"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "CORE-R1", "severity": "high", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "CORE-R1", "symptom": "resolver unreachable", "domain": "safe.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name safe.local", "ip name-server 8.8.8.8", "ip name-server 1.1.1.1"]}
{"incident_type": "dns_issues", "instruction": "Analyze network services incidents (DNS/NTP/ARP security) and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "DNS resolution issues detected", "device": "EDGE-FW1", "severity": "medium", "description": "DNS queries failing or high NXDOMAIN/timeout rate observed."}, "devices": [{"name": "EDGE-FW1", "symptom": "DNS timeout", "domain": "corp.local", "current_dns": ["8.8.8.8"]}], "cli_fix": ["ip domain-lookup", "ip domain-name corp.local", "ip name-server 8.8.8.8", "ip name-server 10.0.1.53"]}