{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.35", "interface": "GigabitEthernet0/6", "errdisable_cause": "udld", "vlan": 20, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/6", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.37", "interface": "GigabitEthernet0/10", "errdisable_cause": "port-security", "vlan": 30, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/10", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.21", "interface": "GigabitEthernet0/22", "errdisable_cause": "port-security", "vlan": 40, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/22", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/12", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.212", "event_vlan": 30, "tcn_count_10min": 200, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/18", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.254", "interface": "GigabitEthernet0/11", "errdisable_cause": "port-security", "vlan": 50, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/11", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.230", "interface": "GigabitEthernet0/1", "errdisable_cause": "port-security", "vlan": 10, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/1", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/2", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.34", "event_vlan": 50, "tcn_count_10min": 200, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/7", "last_tcn_port": "GigabitEthernet0/7", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/7", "spanning-tree guard root"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.153", "event_vlan": 99, "mac": "678F.B7AF.00E3", "interfaces": ["GigabitEthernet0/15", "GigabitEthernet0/16"], "mac_move_count_5min": 20, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.63", "event_vlan": 10, "tcn_count_10min": 200, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/12", "last_tcn_port": "GigabitEthernet0/12", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.103", "event_vlan": 10, "tcn_count_10min": 20, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/3", "last_tcn_port": "GigabitEthernet0/3", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 10 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.83", "event_vlan": 40, "mac": "1028.088E.BB8D", "interfaces": ["TenGigabitEthernet1/1/2", "TenGigabitEthernet1/1/1"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.58", "event_vlan": 99, "tcn_count_10min": 5, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/7", "last_tcn_port": "TenGigabitEthernet1/1/3", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.72", "interface": "GigabitEthernet0/15", "errdisable_cause": "udld", "vlan": 50, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/15", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.11", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/12", "last_tcn_port": "GigabitEthernet0/4", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.43", "event_vlan": 30, "tcn_count_10min": 200, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/2", "last_tcn_port": "GigabitEthernet0/2", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 30 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.65", "event_vlan": 50, "mac": "88CA.4405.89ED", "interfaces": ["GigabitEthernet0/10", "GigabitEthernet0/4"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/10", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/17", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.199", "interface": "GigabitEthernet0/17", "errdisable_cause": "port-security", "vlan": 50, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/17", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/2", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.254", "interface": "GigabitEthernet0/2", "errdisable_cause": "udld", "vlan": 50, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/2", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.57", "event_vlan": 10, "tcn_count_10min": 20, "root_bridge_vlan": 30, "root_port": "TenGigabitEthernet1/1/2", "last_tcn_port": "GigabitEthernet0/9", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/9", "spanning-tree guard root"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.185", "event_vlan": 50, "mac": "B226.0C6F.5208", "interfaces": ["GigabitEthernet0/1", "GigabitEthernet0/6"], "mac_move_count_5min": 20, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/1", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.218", "event_vlan": 40, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/15", "last_tcn_port": "GigabitEthernet0/15", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.190", "interface": "GigabitEthernet0/6", "errdisable_cause": "port-security", "vlan": 10, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/6", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.210", "event_vlan": 30, "tcn_count_10min": 60, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/23", "last_tcn_port": "GigabitEthernet0/23", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 30 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/17", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.228", "interface": "GigabitEthernet0/17", "errdisable_cause": "storm-control", "vlan": 40, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/17", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.38", "event_vlan": 10, "tcn_count_10min": 20, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 10 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/7", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.118", "event_vlan": 30, "mac": "BF66.90D8.2EAD", "interfaces": ["GigabitEthernet0/7", "GigabitEthernet0/18"], "mac_move_count_5min": 50, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/6", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.142", "interface": "GigabitEthernet0/6", "errdisable_cause": "port-security", "vlan": 50, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/6", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.32", "interface": "TenGigabitEthernet1/1/2", "errdisable_cause": "bpduguard", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.119", "event_vlan": 20, "tcn_count_10min": 20, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/8", "last_tcn_port": "TenGigabitEthernet1/1/4", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "TenGigabitEthernet1/1/1", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.130", "interface": "TenGigabitEthernet1/1/1", "errdisable_cause": "link-flap", "vlan": 30, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/4", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.15", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/19", "last_tcn_port": "GigabitEthernet0/7", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/7", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.93", "event_vlan": 20, "tcn_count_10min": 20, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/17", "last_tcn_port": "GigabitEthernet0/17", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/17", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.205", "interface": "GigabitEthernet0/11", "errdisable_cause": "port-security", "vlan": 20, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/11", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.187", "interface": "GigabitEthernet0/12", "errdisable_cause": "udld", "vlan": 30, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/12", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.248", "interface": "GigabitEthernet0/4", "errdisable_cause": "port-security", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/4", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/21", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.142", "event_vlan": 50, "tcn_count_10min": 60, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/24", "last_tcn_port": "GigabitEthernet0/24", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/24", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.190", "interface": "GigabitEthernet0/21", "errdisable_cause": "udld", "vlan": 30, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/21", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/2", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.171", "event_vlan": 20, "tcn_count_10min": 60, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/18", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/7", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.77", "interface": "GigabitEthernet0/7", "errdisable_cause": "bpduguard", "vlan": 30, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/7", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.169", "interface": "GigabitEthernet0/16", "errdisable_cause": "link-flap", "vlan": 20, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/5", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.2", "event_vlan": 50, "tcn_count_10min": 20, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/15", "last_tcn_port": "GigabitEthernet0/15", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 50 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.60", "interface": "GigabitEthernet0/3", "errdisable_cause": "storm-control", "vlan": 40, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/3", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.29", "interface": "GigabitEthernet0/11", "errdisable_cause": "udld", "vlan": 10, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/11", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.135", "event_vlan": 99, "mac": "231E.B4FE.2A93", "interfaces": ["TenGigabitEthernet1/1/2", "GigabitEthernet0/18"], "mac_move_count_5min": 50, "possible_causes": "bridge"}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.4", "interface": "GigabitEthernet0/3", "errdisable_cause": "link-flap", "vlan": 40, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.185", "event_vlan": 50, "mac": "536E.8D84.123A", "interfaces": ["GigabitEthernet0/22", "GigabitEthernet0/12"], "mac_move_count_5min": 50, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/17", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.112", "interface": "GigabitEthernet0/17", "errdisable_cause": "port-security", "vlan": 10, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/17", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.71", "event_vlan": 50, "mac": "847D.1DB6.286B", "interfaces": ["GigabitEthernet0/22", "GigabitEthernet0/2"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.139", "interface": "GigabitEthernet0/21", "errdisable_cause": "port-security", "vlan": 99, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/21", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.210", "interface": "GigabitEthernet0/8", "errdisable_cause": "udld", "vlan": 20, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/8", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.113", "event_vlan": 50, "tcn_count_10min": 200, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/12", "last_tcn_port": "GigabitEthernet0/12", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/14", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.189", "event_vlan": 99, "mac": "7C21.9604.8426", "interfaces": ["GigabitEthernet0/16", "GigabitEthernet0/14"], "mac_move_count_5min": 50, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/14", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.210", "event_vlan": 99, "tcn_count_10min": 20, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/15", "last_tcn_port": "GigabitEthernet0/15", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/15", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/3", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.86", "interface": "TenGigabitEthernet1/1/3", "errdisable_cause": "link-flap", "vlan": 99, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/3", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.107", "event_vlan": 50, "tcn_count_10min": 20, "root_bridge_vlan": 50, "root_port": "TenGigabitEthernet1/1/4", "last_tcn_port": "GigabitEthernet0/10", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.158", "event_vlan": 20, "tcn_count_10min": 60, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/13", "last_tcn_port": "GigabitEthernet0/13", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/13", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/2", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.215", "interface": "TenGigabitEthernet1/1/2", "errdisable_cause": "storm-control", "vlan": 99, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.101", "event_vlan": 50, "tcn_count_10min": 20, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/6", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/4", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.215", "interface": "TenGigabitEthernet1/1/4", "errdisable_cause": "storm-control", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/11", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.233", "event_vlan": 50, "tcn_count_10min": 5, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/23", "last_tcn_port": "GigabitEthernet0/4", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/4", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/1", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.245", "interface": "TenGigabitEthernet1/1/1", "errdisable_cause": "udld", "vlan": 50, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.234", "event_vlan": 20, "mac": "99F1.0116.4603", "interfaces": ["GigabitEthernet0/15", "GigabitEthernet0/21"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/14", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.17", "event_vlan": 99, "mac": "CDAC.4BC7.F258", "interfaces": ["GigabitEthernet0/10", "GigabitEthernet0/14"], "mac_move_count_5min": 50, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/14", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/22", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.79", "interface": "GigabitEthernet0/22", "errdisable_cause": "link-flap", "vlan": 99, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.74", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/24", "last_tcn_port": "GigabitEthernet0/24", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/24", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/12", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.178", "interface": "GigabitEthernet0/12", "errdisable_cause": "link-flap", "vlan": 20, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.32", "interface": "GigabitEthernet0/5", "errdisable_cause": "storm-control", "vlan": 40, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/5", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.166", "event_vlan": 30, "mac": "BF0A.BC77.283C", "interfaces": ["GigabitEthernet0/23", "GigabitEthernet0/1"], "mac_move_count_5min": 20, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/23", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.144", "event_vlan": 30, "mac": "9F4A.B043.3B5A", "interfaces": ["TenGigabitEthernet1/1/3", "GigabitEthernet0/21"], "mac_move_count_5min": 50, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.221", "event_vlan": 50, "mac": "2AD2.E517.CC1F", "interfaces": ["GigabitEthernet0/19", "TenGigabitEthernet1/1/2"], "mac_move_count_5min": 20, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/19", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.104", "event_vlan": 30, "mac": "942A.3C7A.EF0C", "interfaces": ["GigabitEthernet0/19", "GigabitEthernet0/21"], "mac_move_count_5min": 50, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/21", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.120", "interface": "GigabitEthernet0/11", "errdisable_cause": "port-security", "vlan": 20, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/11", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.129", "event_vlan": 40, "mac": "6EFA.0C31.5AA0", "interfaces": ["GigabitEthernet0/20", "TenGigabitEthernet1/1/4"], "mac_move_count_5min": 20, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/20", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/11", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.65", "event_vlan": 40, "mac": "BA7B.6DE0.FD7B", "interfaces": ["GigabitEthernet0/21", "GigabitEthernet0/11"], "mac_move_count_5min": 50, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.157", "interface": "TenGigabitEthernet1/1/2", "errdisable_cause": "storm-control", "vlan": 20, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.95", "event_vlan": 30, "mac": "5B25.A6F7.4930", "interfaces": ["GigabitEthernet0/15", "GigabitEthernet0/10"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/1", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.233", "event_vlan": 99, "mac": "C6BB.FBF8.448A", "interfaces": ["TenGigabitEthernet1/1/1", "GigabitEthernet0/2"], "mac_move_count_5min": 300, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "TenGigabitEthernet1/1/4", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.227", "interface": "TenGigabitEthernet1/1/4", "errdisable_cause": "bpduguard", "vlan": 20, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/20", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.135", "event_vlan": 40, "tcn_count_10min": 20, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/12", "last_tcn_port": "GigabitEthernet0/19", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/19", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.86", "interface": "GigabitEthernet0/19", "errdisable_cause": "link-flap", "vlan": 99, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.231", "interface": "GigabitEthernet0/10", "errdisable_cause": "link-flap", "vlan": 10, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.46", "event_vlan": 30, "tcn_count_10min": 200, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/21", "last_tcn_port": "GigabitEthernet0/1", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 30 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/15", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.230", "interface": "GigabitEthernet0/15", "errdisable_cause": "storm-control", "vlan": 20, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/15", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.76", "event_vlan": 30, "tcn_count_10min": 200, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/14", "last_tcn_port": "GigabitEthernet0/14", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/14", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.31", "interface": "GigabitEthernet0/13", "errdisable_cause": "port-security", "vlan": 50, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/13", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.163", "event_vlan": 20, "mac": "31AE.0806.C0B6", "interfaces": ["TenGigabitEthernet1/1/4", "GigabitEthernet0/9"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/9", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "TenGigabitEthernet1/1/4", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.167", "interface": "TenGigabitEthernet1/1/4", "errdisable_cause": "link-flap", "vlan": 40, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/2", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.191", "event_vlan": 30, "mac": "4FC5.2306.FA7A", "interfaces": ["GigabitEthernet0/2", "TenGigabitEthernet1/1/2"], "mac_move_count_5min": 300, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/18", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.225", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/13", "last_tcn_port": "GigabitEthernet0/13", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/13", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/2", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.23", "interface": "GigabitEthernet0/2", "errdisable_cause": "port-security", "vlan": 30, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/2", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.254", "event_vlan": 20, "mac": "B15A.C89B.3795", "interfaces": ["GigabitEthernet0/24", "GigabitEthernet0/5"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/24", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/8", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.119", "interface": "GigabitEthernet0/8", "errdisable_cause": "bpduguard", "vlan": 99, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/8", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.232", "event_vlan": 40, "mac": "7BD2.D266.7652", "interfaces": ["GigabitEthernet0/10", "GigabitEthernet0/16"], "mac_move_count_5min": 300, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.84", "event_vlan": 99, "tcn_count_10min": 200, "root_bridge_vlan": 99, "root_port": "TenGigabitEthernet1/1/4", "last_tcn_port": "TenGigabitEthernet1/1/4", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "spanning-tree guard root"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.226", "event_vlan": 40, "mac": "70C0.3782.8B15", "interfaces": ["GigabitEthernet0/9", "GigabitEthernet0/12"], "mac_move_count_5min": 20, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.247", "event_vlan": 30, "tcn_count_10min": 60, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/2", "last_tcn_port": "GigabitEthernet0/20", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/20", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/19", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.152", "event_vlan": 50, "tcn_count_10min": 60, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/14", "last_tcn_port": "GigabitEthernet0/14", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/14", "spanning-tree guard root"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/5", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.171", "event_vlan": 10, "mac": "4E95.A1E7.EC9E", "interfaces": ["GigabitEthernet0/5", "GigabitEthernet0/23"], "mac_move_count_5min": 20, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.209", "event_vlan": 40, "tcn_count_10min": 60, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/17", "last_tcn_port": "GigabitEthernet0/21", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.224", "interface": "GigabitEthernet0/24", "errdisable_cause": "bpduguard", "vlan": 50, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/24", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.39", "event_vlan": 50, "mac": "05E4.A18B.661D", "interfaces": ["GigabitEthernet0/6", "GigabitEthernet0/19"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/19", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.224", "event_vlan": 99, "tcn_count_10min": 60, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/13", "last_tcn_port": "GigabitEthernet0/13", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/13", "spanning-tree guard root"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/4", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.233", "event_vlan": 10, "mac": "9CFD.E43F.4E29", "interfaces": ["GigabitEthernet0/4", "GigabitEthernet0/15"], "mac_move_count_5min": 20, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.100", "event_vlan": 10, "mac": "5511.412C.413A", "interfaces": ["GigabitEthernet0/1", "GigabitEthernet0/19"], "mac_move_count_5min": 20, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/1", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/10", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.6", "event_vlan": 50, "mac": "FAE7.6C0A.EF83", "interfaces": ["GigabitEthernet0/20", "GigabitEthernet0/10"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.243", "event_vlan": 99, "tcn_count_10min": 60, "root_bridge_vlan": 99, "root_port": "TenGigabitEthernet1/1/4", "last_tcn_port": "TenGigabitEthernet1/1/4", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.41", "interface": "GigabitEthernet0/18", "errdisable_cause": "port-security", "vlan": 20, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/18", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.105", "event_vlan": 20, "tcn_count_10min": 200, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/7", "last_tcn_port": "GigabitEthernet0/7", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "TenGigabitEthernet1/1/2", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.24", "event_vlan": 10, "mac": "A175.AEAF.D441", "interfaces": ["TenGigabitEthernet1/1/2", "GigabitEthernet0/12"], "mac_move_count_5min": 120, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/12", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.136", "interface": "GigabitEthernet0/21", "errdisable_cause": "storm-control", "vlan": 10, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/21", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.124", "event_vlan": 10, "mac": "228C.4F6E.C0B9", "interfaces": ["GigabitEthernet0/19", "GigabitEthernet0/22"], "mac_move_count_5min": 300, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/8", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.120", "event_vlan": 50, "tcn_count_10min": 5, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/23", "last_tcn_port": "TenGigabitEthernet1/1/3", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/2", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.186", "event_vlan": 30, "tcn_count_10min": 200, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/23", "last_tcn_port": "GigabitEthernet0/23", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 30 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/23", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.141", "event_vlan": 30, "tcn_count_10min": 200, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/9", "last_tcn_port": "GigabitEthernet0/9", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/9", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.6", "event_vlan": 40, "tcn_count_10min": 20, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/19", "last_tcn_port": "TenGigabitEthernet1/1/4", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/3", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.95", "interface": "GigabitEthernet0/3", "errdisable_cause": "port-security", "vlan": 20, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/3", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.149", "event_vlan": 10, "mac": "9295.C87A.61EC", "interfaces": ["GigabitEthernet0/10", "GigabitEthernet0/18"], "mac_move_count_5min": 50, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.10", "event_vlan": 99, "mac": "D3F8.461F.E861", "interfaces": ["GigabitEthernet0/5", "GigabitEthernet0/18"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/20", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.2", "event_vlan": 30, "tcn_count_10min": 20, "root_bridge_vlan": 20, "root_port": "TenGigabitEthernet1/1/1", "last_tcn_port": "GigabitEthernet0/17", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/1", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.136", "event_vlan": 30, "tcn_count_10min": 60, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/4", "last_tcn_port": "GigabitEthernet0/19", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/19", "spanning-tree guard root"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/13", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.231", "event_vlan": 99, "mac": "6724.7CA6.1D57", "interfaces": ["GigabitEthernet0/13", "TenGigabitEthernet1/1/4"], "mac_move_count_5min": 300, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/13", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/17", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.231", "interface": "GigabitEthernet0/17", "errdisable_cause": "storm-control", "vlan": 10, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/17", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.198", "interface": "GigabitEthernet0/4", "errdisable_cause": "bpduguard", "vlan": 99, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/4", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.153", "interface": "GigabitEthernet0/9", "errdisable_cause": "udld", "vlan": 30, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "TenGigabitEthernet1/1/4", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.28", "event_vlan": 20, "mac": "0E01.ADEC.569B", "interfaces": ["TenGigabitEthernet1/1/4", "GigabitEthernet0/9"], "mac_move_count_5min": 50, "possible_causes": "bridge"}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.17", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/5", "last_tcn_port": "GigabitEthernet0/11", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/4", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.60", "event_vlan": 20, "mac": "4068.2888.265D", "interfaces": ["GigabitEthernet0/10", "GigabitEthernet0/4"], "mac_move_count_5min": 50, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/10", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.113", "interface": "GigabitEthernet0/10", "errdisable_cause": "port-security", "vlan": 50, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/10", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/17", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.113", "interface": "GigabitEthernet0/17", "errdisable_cause": "port-security", "vlan": 50, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/17", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.169", "event_vlan": 99, "mac": "1B75.29CC.BB3F", "interfaces": ["GigabitEthernet0/16", "GigabitEthernet0/11"], "mac_move_count_5min": 120, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.102", "event_vlan": 40, "mac": "8E66.5974.B039", "interfaces": ["GigabitEthernet0/17", "GigabitEthernet0/15"], "mac_move_count_5min": 50, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/15", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.191", "event_vlan": 40, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/23", "last_tcn_port": "GigabitEthernet0/23", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/23", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/4", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.7", "interface": "GigabitEthernet0/4", "errdisable_cause": "bpduguard", "vlan": 10, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/4", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.108", "event_vlan": 50, "tcn_count_10min": 60, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/22", "last_tcn_port": "GigabitEthernet0/16", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/16", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.177", "event_vlan": 20, "tcn_count_10min": 60, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/5", "last_tcn_port": "GigabitEthernet0/16", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/3", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.143", "interface": "TenGigabitEthernet1/1/3", "errdisable_cause": "storm-control", "vlan": 50, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.114", "event_vlan": 30, "mac": "CC47.71CB.B622", "interfaces": ["GigabitEthernet0/16", "GigabitEthernet0/17"], "mac_move_count_5min": 50, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/16", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/3", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.163", "event_vlan": 40, "mac": "5C14.50A4.1E6D", "interfaces": ["GigabitEthernet0/19", "TenGigabitEthernet1/1/3"], "mac_move_count_5min": 300, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.106", "event_vlan": 99, "mac": "521B.AE95.31E5", "interfaces": ["GigabitEthernet0/4", "GigabitEthernet0/1"], "mac_move_count_5min": 20, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/7", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.13", "event_vlan": 99, "tcn_count_10min": 60, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/9", "last_tcn_port": "GigabitEthernet0/9", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.123", "interface": "GigabitEthernet0/10", "errdisable_cause": "port-security", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/10", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/9", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.184", "event_vlan": 30, "tcn_count_10min": 200, "root_bridge_vlan": 30, "root_port": "TenGigabitEthernet1/1/1", "last_tcn_port": "GigabitEthernet0/21", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/21", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.176", "interface": "GigabitEthernet0/21", "errdisable_cause": "storm-control", "vlan": 30, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/21", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.32", "interface": "GigabitEthernet0/15", "errdisable_cause": "udld", "vlan": 99, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/15", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.63", "event_vlan": 40, "mac": "ABA6.0696.EAE1", "interfaces": ["GigabitEthernet0/1", "TenGigabitEthernet1/1/2"], "mac_move_count_5min": 120, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "TenGigabitEthernet1/1/3", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.219", "event_vlan": 30, "tcn_count_10min": 60, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/10", "last_tcn_port": "TenGigabitEthernet1/1/3", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.7", "interface": "GigabitEthernet0/13", "errdisable_cause": "udld", "vlan": 40, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/13", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.90", "event_vlan": 30, "tcn_count_10min": 200, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/19", "last_tcn_port": "GigabitEthernet0/19", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/19", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/23", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.42", "event_vlan": 30, "mac": "8081.E113.AA28", "interfaces": ["GigabitEthernet0/1", "GigabitEthernet0/23"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/3", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.129", "event_vlan": 40, "mac": "F433.F90E.3BA9", "interfaces": ["TenGigabitEthernet1/1/3", "TenGigabitEthernet1/1/2"], "mac_move_count_5min": 50, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.234", "event_vlan": 30, "tcn_count_10min": 200, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/20", "last_tcn_port": "GigabitEthernet0/6", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 30 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/20", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.181", "interface": "GigabitEthernet0/20", "errdisable_cause": "storm-control", "vlan": 10, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/20", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.91", "interface": "GigabitEthernet0/11", "errdisable_cause": "port-security", "vlan": 10, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/11", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/2", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.177", "interface": "TenGigabitEthernet1/1/2", "errdisable_cause": "port-security", "vlan": 30, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.130", "interface": "GigabitEthernet0/24", "errdisable_cause": "udld", "vlan": 20, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/24", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/13", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.44", "event_vlan": 30, "mac": "0988.1D63.CFEA", "interfaces": ["GigabitEthernet0/10", "GigabitEthernet0/13"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/13", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.218", "event_vlan": 99, "tcn_count_10min": 20, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/3", "last_tcn_port": "GigabitEthernet0/3", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/3", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/13", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.215", "event_vlan": 30, "tcn_count_10min": 20, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/23", "last_tcn_port": "TenGigabitEthernet1/1/1", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/10", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.197", "event_vlan": 30, "tcn_count_10min": 60, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/9", "last_tcn_port": "GigabitEthernet0/9", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 30 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.85", "event_vlan": 30, "mac": "79C1.91C3.9A6F", "interfaces": ["GigabitEthernet0/12", "GigabitEthernet0/23"], "mac_move_count_5min": 120, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.109", "event_vlan": 40, "tcn_count_10min": 60, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/11", "last_tcn_port": "GigabitEthernet0/5", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/5", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.135", "interface": "GigabitEthernet0/17", "errdisable_cause": "udld", "vlan": 30, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/17", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/2", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.36", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/1", "last_tcn_port": "GigabitEthernet0/15", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/15", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/20", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.141", "event_vlan": 99, "tcn_count_10min": 200, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/19", "last_tcn_port": "GigabitEthernet0/21", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/21", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/21", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.18", "interface": "GigabitEthernet0/21", "errdisable_cause": "link-flap", "vlan": 30, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/19", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.80", "event_vlan": 40, "tcn_count_10min": 200, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/9", "last_tcn_port": "GigabitEthernet0/2", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.59", "event_vlan": 50, "tcn_count_10min": 20, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/11", "last_tcn_port": "TenGigabitEthernet1/1/2", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/19", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.80", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/22", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/22", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.250", "event_vlan": 99, "tcn_count_10min": 5, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/2", "last_tcn_port": "GigabitEthernet0/2", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 99 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.109", "event_vlan": 20, "tcn_count_10min": 200, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/12", "last_tcn_port": "GigabitEthernet0/9", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/9", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/24", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.74", "event_vlan": 10, "mac": "10CB.A3AC.3940", "interfaces": ["TenGigabitEthernet1/1/3", "GigabitEthernet0/24"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/24", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.228", "event_vlan": 20, "mac": "FA57.C1C1.BFB7", "interfaces": ["GigabitEthernet0/13", "GigabitEthernet0/10"], "mac_move_count_5min": 120, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/10", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.230", "event_vlan": 30, "mac": "9FA4.0945.E815", "interfaces": ["GigabitEthernet0/18", "GigabitEthernet0/2"], "mac_move_count_5min": 300, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.163", "event_vlan": 99, "mac": "F86A.8A40.663C", "interfaces": ["TenGigabitEthernet1/1/4", "GigabitEthernet0/10"], "mac_move_count_5min": 50, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.199", "event_vlan": 10, "mac": "2EFC.AAB4.D3E6", "interfaces": ["GigabitEthernet0/15", "GigabitEthernet0/3"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.174", "event_vlan": 40, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "TenGigabitEthernet1/1/2", "last_tcn_port": "TenGigabitEthernet1/1/2", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/2", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.7", "interface": "GigabitEthernet0/2", "errdisable_cause": "port-security", "vlan": 50, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/2", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/12", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.145", "event_vlan": 50, "mac": "C83F.9B2B.9A0D", "interfaces": ["GigabitEthernet0/12", "TenGigabitEthernet1/1/4"], "mac_move_count_5min": 20, "possible_causes": "bridge"}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/7", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.109", "interface": "GigabitEthernet0/7", "errdisable_cause": "port-security", "vlan": 50, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/7", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.61", "interface": "GigabitEthernet0/7", "errdisable_cause": "port-security", "vlan": 20, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/7", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/9", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.139", "interface": "GigabitEthernet0/9", "errdisable_cause": "udld", "vlan": 20, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/9", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.253", "interface": "GigabitEthernet0/15", "errdisable_cause": "bpduguard", "vlan": 20, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/15", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.76", "event_vlan": 99, "tcn_count_10min": 200, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/3", "last_tcn_port": "GigabitEthernet0/21", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/16", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.100", "event_vlan": 99, "mac": "880D.DE53.707F", "interfaces": ["GigabitEthernet0/16", "GigabitEthernet0/6"], "mac_move_count_5min": 50, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/6", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/2", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.18", "interface": "TenGigabitEthernet1/1/2", "errdisable_cause": "port-security", "vlan": 99, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.53", "event_vlan": 99, "tcn_count_10min": 60, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/7", "last_tcn_port": "GigabitEthernet0/3", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.70", "interface": "GigabitEthernet0/22", "errdisable_cause": "bpduguard", "vlan": 10, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/22", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/4", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.239", "interface": "GigabitEthernet0/4", "errdisable_cause": "link-flap", "vlan": 40, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.222", "event_vlan": 30, "mac": "9D39.F25D.0889", "interfaces": ["GigabitEthernet0/17", "GigabitEthernet0/4"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.238", "interface": "GigabitEthernet0/12", "errdisable_cause": "port-security", "vlan": 50, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/12", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.231", "event_vlan": 50, "tcn_count_10min": 5, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/7", "last_tcn_port": "GigabitEthernet0/7", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/7", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.95", "interface": "GigabitEthernet0/23", "errdisable_cause": "bpduguard", "vlan": 10, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/23", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.116", "event_vlan": 99, "mac": "0035.170F.CF96", "interfaces": ["GigabitEthernet0/12", "TenGigabitEthernet1/1/2"], "mac_move_count_5min": 300, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.174", "event_vlan": 20, "tcn_count_10min": 200, "root_bridge_vlan": 50, "root_port": "TenGigabitEthernet1/1/2", "last_tcn_port": "GigabitEthernet0/9", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 20 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.212", "interface": "GigabitEthernet0/10", "errdisable_cause": "udld", "vlan": 10, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/10", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.217", "event_vlan": 20, "mac": "0A67.0906.AA63", "interfaces": ["GigabitEthernet0/20", "GigabitEthernet0/14"], "mac_move_count_5min": 120, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/20", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/11", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.115", "event_vlan": 40, "tcn_count_10min": 60, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/6", "last_tcn_port": "GigabitEthernet0/6", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/6", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.114", "event_vlan": 40, "tcn_count_10min": 60, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/2", "last_tcn_port": "GigabitEthernet0/2", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.122", "event_vlan": 10, "tcn_count_10min": 200, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/7", "last_tcn_port": "GigabitEthernet0/1", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.10", "event_vlan": 10, "tcn_count_10min": 5, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/13", "last_tcn_port": "GigabitEthernet0/19", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/19", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/2", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.70", "interface": "GigabitEthernet0/2", "errdisable_cause": "storm-control", "vlan": 10, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/2", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/1", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.97", "event_vlan": 10, "tcn_count_10min": 60, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/18", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.135", "event_vlan": 40, "mac": "4CCD.7E3F.B675", "interfaces": ["GigabitEthernet0/7", "GigabitEthernet0/24"], "mac_move_count_5min": 120, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/24", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.107", "interface": "GigabitEthernet0/19", "errdisable_cause": "port-security", "vlan": 50, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.245", "event_vlan": 10, "tcn_count_10min": 60, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/1", "last_tcn_port": "GigabitEthernet0/1", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/1", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.70", "event_vlan": 30, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/20", "last_tcn_port": "GigabitEthernet0/15", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/9", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.66", "interface": "GigabitEthernet0/9", "errdisable_cause": "storm-control", "vlan": 50, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.97", "interface": "GigabitEthernet0/24", "errdisable_cause": "bpduguard", "vlan": 50, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/24", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.39", "event_vlan": 50, "mac": "7233.DFE8.A814", "interfaces": ["GigabitEthernet0/24", "GigabitEthernet0/19"], "mac_move_count_5min": 20, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/24", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/2", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.240", "event_vlan": 30, "tcn_count_10min": 60, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/23", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/19", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.101", "event_vlan": 40, "tcn_count_10min": 60, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/13", "last_tcn_port": "GigabitEthernet0/1", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/1", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/14", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.137", "event_vlan": 10, "mac": "70E2.ADE7.74C8", "interfaces": ["GigabitEthernet0/3", "GigabitEthernet0/14"], "mac_move_count_5min": 50, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/3", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/14", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.51", "interface": "GigabitEthernet0/14", "errdisable_cause": "udld", "vlan": 40, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/14", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/2", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.70", "interface": "TenGigabitEthernet1/1/2", "errdisable_cause": "udld", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.53", "interface": "GigabitEthernet0/21", "errdisable_cause": "link-flap", "vlan": 10, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/6", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.47", "event_vlan": 50, "mac": "C44D.A87A.0D20", "interfaces": ["GigabitEthernet0/6", "GigabitEthernet0/19"], "mac_move_count_5min": 50, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/19", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.165", "event_vlan": 40, "mac": "99E7.468F.1067", "interfaces": ["GigabitEthernet0/5", "GigabitEthernet0/12"], "mac_move_count_5min": 20, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.216", "event_vlan": 30, "mac": "BA5A.F525.DD19", "interfaces": ["GigabitEthernet0/22", "GigabitEthernet0/21"], "mac_move_count_5min": 120, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "TenGigabitEthernet1/1/4", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.103", "interface": "TenGigabitEthernet1/1/4", "errdisable_cause": "bpduguard", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.52", "interface": "GigabitEthernet0/8", "errdisable_cause": "storm-control", "vlan": 40, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/8", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.80", "interface": "GigabitEthernet0/22", "errdisable_cause": "port-security", "vlan": 40, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/22", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/4", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.15", "interface": "GigabitEthernet0/4", "errdisable_cause": "link-flap", "vlan": 30, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.136", "event_vlan": 50, "tcn_count_10min": 60, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/12", "last_tcn_port": "GigabitEthernet0/23", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/23", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.186", "event_vlan": 30, "tcn_count_10min": 60, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/19", "last_tcn_port": "GigabitEthernet0/19", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 30 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "TenGigabitEthernet1/1/2", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.189", "event_vlan": 20, "tcn_count_10min": 20, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/12", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.119", "interface": "GigabitEthernet0/23", "errdisable_cause": "bpduguard", "vlan": 10, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/23", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.195", "event_vlan": 20, "mac": "A32B.27C6.198C", "interfaces": ["GigabitEthernet0/20", "GigabitEthernet0/7"], "mac_move_count_5min": 300, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.122", "event_vlan": 50, "tcn_count_10min": 60, "root_bridge_vlan": 50, "root_port": "TenGigabitEthernet1/1/1", "last_tcn_port": "TenGigabitEthernet1/1/1", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 50 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/19", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.186", "event_vlan": 99, "tcn_count_10min": 60, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/6", "last_tcn_port": "GigabitEthernet0/6", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/6", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.142", "event_vlan": 20, "mac": "D390.BB82.0048", "interfaces": ["GigabitEthernet0/13", "GigabitEthernet0/20"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/20", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/22", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.226", "interface": "GigabitEthernet0/22", "errdisable_cause": "udld", "vlan": 99, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/22", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.88", "event_vlan": 10, "tcn_count_10min": 60, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/6", "last_tcn_port": "TenGigabitEthernet1/1/4", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 10 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.254", "event_vlan": 30, "tcn_count_10min": 60, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/12", "last_tcn_port": "GigabitEthernet0/12", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.143", "event_vlan": 40, "mac": "E677.BC1B.6826", "interfaces": ["TenGigabitEthernet1/1/2", "GigabitEthernet0/23"], "mac_move_count_5min": 20, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.249", "interface": "GigabitEthernet0/5", "errdisable_cause": "storm-control", "vlan": 30, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/5", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/12", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.57", "event_vlan": 30, "tcn_count_10min": 5, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/10", "last_tcn_port": "TenGigabitEthernet1/1/1", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/2", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.92", "event_vlan": 50, "tcn_count_10min": 200, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/12", "last_tcn_port": "GigabitEthernet0/12", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.250", "event_vlan": 10, "mac": "B2F0.CD1A.FEBD", "interfaces": ["GigabitEthernet0/9", "GigabitEthernet0/23"], "mac_move_count_5min": 50, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/23", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/1", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.112", "event_vlan": 40, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/20", "last_tcn_port": "GigabitEthernet0/20", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.236", "event_vlan": 99, "mac": "5D2F.8DF2.9B43", "interfaces": ["GigabitEthernet0/14", "GigabitEthernet0/19"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/14", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.43", "event_vlan": 30, "tcn_count_10min": 5, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/14", "last_tcn_port": "TenGigabitEthernet1/1/1", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 30 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.27", "interface": "GigabitEthernet0/14", "errdisable_cause": "storm-control", "vlan": 40, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/14", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "TenGigabitEthernet1/1/3", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.160", "event_vlan": 30, "mac": "2CFE.1132.0180", "interfaces": ["TenGigabitEthernet1/1/3", "GigabitEthernet0/19"], "mac_move_count_5min": 20, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/19", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.129", "event_vlan": 20, "tcn_count_10min": 60, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/4", "last_tcn_port": "GigabitEthernet0/4", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/4", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.120", "interface": "GigabitEthernet0/11", "errdisable_cause": "link-flap", "vlan": 30, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/3", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.209", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/20", "last_tcn_port": "GigabitEthernet0/20", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/20", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/10", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.232", "event_vlan": 50, "mac": "4320.456E.4A84", "interfaces": ["GigabitEthernet0/23", "GigabitEthernet0/10"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/23", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.55", "event_vlan": 99, "tcn_count_10min": 60, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/4", "last_tcn_port": "TenGigabitEthernet1/1/3", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/11", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.67", "interface": "GigabitEthernet0/11", "errdisable_cause": "storm-control", "vlan": 99, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/11", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.196", "event_vlan": 50, "mac": "4369.2AA3.DF34", "interfaces": ["GigabitEthernet0/7", "GigabitEthernet0/15"], "mac_move_count_5min": 120, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.32", "event_vlan": 40, "tcn_count_10min": 20, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/4", "last_tcn_port": "GigabitEthernet0/4", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.218", "interface": "GigabitEthernet0/20", "errdisable_cause": "storm-control", "vlan": 99, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/20", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.119", "event_vlan": 50, "mac": "6DB5.2793.E698", "interfaces": ["GigabitEthernet0/12", "GigabitEthernet0/3"], "mac_move_count_5min": 50, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.74", "interface": "GigabitEthernet0/24", "errdisable_cause": "storm-control", "vlan": 30, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/24", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/8", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.103", "event_vlan": 10, "mac": "BCF7.6ABA.562A", "interfaces": ["GigabitEthernet0/9", "GigabitEthernet0/8"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.56", "event_vlan": 99, "tcn_count_10min": 200, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/12", "last_tcn_port": "TenGigabitEthernet1/1/3", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 99 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.135", "event_vlan": 99, "mac": "7837.601A.5E6A", "interfaces": ["GigabitEthernet0/19", "GigabitEthernet0/16"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/19", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/3", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.164", "event_vlan": 10, "mac": "592C.D30B.1A97", "interfaces": ["GigabitEthernet0/8", "TenGigabitEthernet1/1/3"], "mac_move_count_5min": 20, "possible_causes": "loop"}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/24", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.239", "event_vlan": 20, "tcn_count_10min": 200, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/8", "last_tcn_port": "GigabitEthernet0/16", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 20 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.238", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/22", "last_tcn_port": "GigabitEthernet0/22", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/22", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/2", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.167", "interface": "TenGigabitEthernet1/1/2", "errdisable_cause": "storm-control", "vlan": 50, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.154", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/14", "last_tcn_port": "TenGigabitEthernet1/1/1", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/4", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.240", "event_vlan": 40, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/10", "last_tcn_port": "GigabitEthernet0/10", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/10", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.107", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/23", "last_tcn_port": "GigabitEthernet0/23", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.37", "event_vlan": 20, "mac": "6439.E4B8.6674", "interfaces": ["GigabitEthernet0/6", "GigabitEthernet0/13"], "mac_move_count_5min": 50, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/6", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.28", "interface": "GigabitEthernet0/6", "errdisable_cause": "port-security", "vlan": 99, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/6", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.29", "interface": "GigabitEthernet0/7", "errdisable_cause": "link-flap", "vlan": 50, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.144", "event_vlan": 40, "tcn_count_10min": 200, "root_bridge_vlan": 99, "root_port": "TenGigabitEthernet1/1/2", "last_tcn_port": "TenGigabitEthernet1/1/2", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.204", "event_vlan": 20, "tcn_count_10min": 60, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/8", "last_tcn_port": "GigabitEthernet0/8", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/8", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.204", "event_vlan": 50, "tcn_count_10min": 60, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/6", "last_tcn_port": "GigabitEthernet0/16", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/16", "spanning-tree guard root"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.20", "event_vlan": 10, "mac": "854A.96CB.9843", "interfaces": ["GigabitEthernet0/17", "GigabitEthernet0/6"], "mac_move_count_5min": 300, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/13", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.253", "interface": "GigabitEthernet0/13", "errdisable_cause": "udld", "vlan": 10, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/13", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.150", "event_vlan": 10, "mac": "7E23.ABD1.27AA", "interfaces": ["GigabitEthernet0/6", "GigabitEthernet0/12"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/4", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.64", "interface": "TenGigabitEthernet1/1/4", "errdisable_cause": "port-security", "vlan": 30, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/7", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.125", "event_vlan": 10, "mac": "7D4C.517A.B80B", "interfaces": ["TenGigabitEthernet1/1/4", "GigabitEthernet0/7"], "mac_move_count_5min": 50, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/23", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.66", "interface": "GigabitEthernet0/23", "errdisable_cause": "bpduguard", "vlan": 10, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/23", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/9", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.169", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/20", "last_tcn_port": "GigabitEthernet0/20", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 20 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.219", "event_vlan": 99, "mac": "E80E.3D04.3FBB", "interfaces": ["GigabitEthernet0/1", "GigabitEthernet0/10"], "mac_move_count_5min": 20, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/1", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/1", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.89", "event_vlan": 20, "tcn_count_10min": 200, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/5", "last_tcn_port": "GigabitEthernet0/20", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/20", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.17", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/22", "last_tcn_port": "GigabitEthernet0/22", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.222", "interface": "GigabitEthernet0/13", "errdisable_cause": "storm-control", "vlan": 20, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/13", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.113", "interface": "GigabitEthernet0/21", "errdisable_cause": "storm-control", "vlan": 10, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/21", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/20", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.57", "event_vlan": 30, "tcn_count_10min": 200, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/3", "last_tcn_port": "GigabitEthernet0/3", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/3", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.161", "event_vlan": 20, "tcn_count_10min": 20, "root_bridge_vlan": 40, "root_port": "TenGigabitEthernet1/1/1", "last_tcn_port": "TenGigabitEthernet1/1/2", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/1", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.115", "event_vlan": 20, "mac": "640A.0981.C22A", "interfaces": ["GigabitEthernet0/21", "TenGigabitEthernet1/1/1"], "mac_move_count_5min": 300, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/3", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.151", "event_vlan": 50, "tcn_count_10min": 60, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/24", "last_tcn_port": "GigabitEthernet0/2", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/2", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.164", "event_vlan": 99, "mac": "8460.57C5.FC2E", "interfaces": ["TenGigabitEthernet1/1/3", "GigabitEthernet0/15"], "mac_move_count_5min": 300, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "TenGigabitEthernet1/1/4", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.108", "event_vlan": 40, "mac": "1CE4.EBC7.F141", "interfaces": ["TenGigabitEthernet1/1/4", "GigabitEthernet0/2"], "mac_move_count_5min": 300, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/4", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.24", "event_vlan": 10, "tcn_count_10min": 60, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/3", "last_tcn_port": "GigabitEthernet0/20", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/20", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.234", "event_vlan": 10, "tcn_count_10min": 5, "root_bridge_vlan": 10, "root_port": "TenGigabitEthernet1/1/3", "last_tcn_port": "TenGigabitEthernet1/1/3", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 10 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.184", "event_vlan": 30, "mac": "FE7B.2D78.B82C", "interfaces": ["GigabitEthernet0/4", "GigabitEthernet0/3"], "mac_move_count_5min": 120, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/1", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.169", "interface": "TenGigabitEthernet1/1/1", "errdisable_cause": "udld", "vlan": 30, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.17", "event_vlan": 99, "tcn_count_10min": 20, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/19", "last_tcn_port": "TenGigabitEthernet1/1/1", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/3", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.69", "interface": "GigabitEthernet0/3", "errdisable_cause": "storm-control", "vlan": 10, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/3", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.195", "event_vlan": 50, "mac": "A656.B4AE.DE41", "interfaces": ["GigabitEthernet0/8", "GigabitEthernet0/23"], "mac_move_count_5min": 50, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/8", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.47", "event_vlan": 30, "mac": "E570.E64D.730E", "interfaces": ["GigabitEthernet0/21", "GigabitEthernet0/16"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.167", "interface": "GigabitEthernet0/16", "errdisable_cause": "udld", "vlan": 20, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/16", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.38", "interface": "GigabitEthernet0/23", "errdisable_cause": "port-security", "vlan": 20, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/23", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.202", "interface": "GigabitEthernet0/6", "errdisable_cause": "link-flap", "vlan": 40, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.227", "event_vlan": 10, "mac": "C43E.3F3E.36FB", "interfaces": ["GigabitEthernet0/9", "GigabitEthernet0/13"], "mac_move_count_5min": 50, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/13", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.152", "event_vlan": 10, "tcn_count_10min": 20, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/17", "last_tcn_port": "GigabitEthernet0/17", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/17", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/9", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.57", "event_vlan": 30, "tcn_count_10min": 60, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/11", "last_tcn_port": "GigabitEthernet0/4", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 30 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/12", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.251", "event_vlan": 99, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "TenGigabitEthernet1/1/1", "last_tcn_port": "GigabitEthernet0/16", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/16", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.237", "event_vlan": 40, "tcn_count_10min": 20, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/16", "last_tcn_port": "GigabitEthernet0/16", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.13", "event_vlan": 10, "tcn_count_10min": 20, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/19", "last_tcn_port": "GigabitEthernet0/1", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/1", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.71", "event_vlan": 99, "mac": "A1E0.AF98.A7E3", "interfaces": ["GigabitEthernet0/17", "GigabitEthernet0/23"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/9", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.171", "event_vlan": 99, "mac": "E362.3632.3450", "interfaces": ["GigabitEthernet0/2", "GigabitEthernet0/9"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/2", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.143", "event_vlan": 20, "mac": "66E5.8473.53BE", "interfaces": ["GigabitEthernet0/13", "GigabitEthernet0/4"], "mac_move_count_5min": 50, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/4", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/10", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.34", "event_vlan": 30, "tcn_count_10min": 60, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/1", "last_tcn_port": "GigabitEthernet0/1", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.131", "event_vlan": 50, "tcn_count_10min": 60, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/15", "last_tcn_port": "GigabitEthernet0/19", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/19", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.30", "interface": "GigabitEthernet0/14", "errdisable_cause": "udld", "vlan": 50, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/14", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.46", "event_vlan": 10, "mac": "8126.66E9.E4B4", "interfaces": ["GigabitEthernet0/10", "GigabitEthernet0/2"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/23", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.8", "interface": "GigabitEthernet0/23", "errdisable_cause": "port-security", "vlan": 50, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/23", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "TenGigabitEthernet1/1/4", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.8", "event_vlan": 30, "tcn_count_10min": 20, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/21", "last_tcn_port": "GigabitEthernet0/21", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 30 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.231", "interface": "GigabitEthernet0/10", "errdisable_cause": "udld", "vlan": 20, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/10", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.168", "event_vlan": 10, "tcn_count_10min": 20, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/12", "last_tcn_port": "GigabitEthernet0/19", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/19", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/10", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.68", "event_vlan": 10, "mac": "4F1F.B7B2.3547", "interfaces": ["GigabitEthernet0/23", "GigabitEthernet0/10"], "mac_move_count_5min": 300, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.104", "interface": "GigabitEthernet0/8", "errdisable_cause": "udld", "vlan": 40, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/8", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.160", "event_vlan": 20, "mac": "69CB.0D3E.9F7E", "interfaces": ["GigabitEthernet0/7", "GigabitEthernet0/22"], "mac_move_count_5min": 300, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.74", "event_vlan": 50, "tcn_count_10min": 5, "root_bridge_vlan": 50, "root_port": "TenGigabitEthernet1/1/3", "last_tcn_port": "GigabitEthernet0/15", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/15", "spanning-tree guard root"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.219", "event_vlan": 40, "mac": "099A.7E52.7E85", "interfaces": ["TenGigabitEthernet1/1/2", "GigabitEthernet0/18"], "mac_move_count_5min": 20, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/23", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.151", "event_vlan": 20, "mac": "CF9C.08BE.68E0", "interfaces": ["GigabitEthernet0/24", "GigabitEthernet0/23"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/23", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "TenGigabitEthernet1/1/3", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.169", "event_vlan": 50, "mac": "5A1A.DA7D.D2F5", "interfaces": ["TenGigabitEthernet1/1/3", "GigabitEthernet0/8"], "mac_move_count_5min": 50, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.163", "event_vlan": 99, "tcn_count_10min": 5, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/20", "last_tcn_port": "GigabitEthernet0/1", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/1", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.91", "interface": "GigabitEthernet0/19", "errdisable_cause": "udld", "vlan": 30, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/23", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.213", "interface": "GigabitEthernet0/23", "errdisable_cause": "bpduguard", "vlan": 99, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/23", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.156", "event_vlan": 99, "mac": "267B.4EE1.A4C6", "interfaces": ["GigabitEthernet0/14", "TenGigabitEthernet1/1/3"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/14", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.151", "interface": "GigabitEthernet0/9", "errdisable_cause": "link-flap", "vlan": 20, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/2", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.110", "event_vlan": 50, "mac": "0527.9899.D0FB", "interfaces": ["TenGigabitEthernet1/1/2", "GigabitEthernet0/5"], "mac_move_count_5min": 300, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/5", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.229", "interface": "GigabitEthernet0/21", "errdisable_cause": "port-security", "vlan": 20, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/21", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/5", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.237", "interface": "GigabitEthernet0/5", "errdisable_cause": "port-security", "vlan": 10, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/5", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.178", "event_vlan": 20, "mac": "7537.218A.57C4", "interfaces": ["GigabitEthernet0/2", "GigabitEthernet0/6"], "mac_move_count_5min": 300, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/2", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/2", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.67", "event_vlan": 40, "mac": "DCDC.3B6D.C9D0", "interfaces": ["GigabitEthernet0/2", "GigabitEthernet0/21"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.87", "interface": "GigabitEthernet0/22", "errdisable_cause": "storm-control", "vlan": 99, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/22", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/10", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.240", "event_vlan": 40, "tcn_count_10min": 20, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/9", "last_tcn_port": "GigabitEthernet0/9", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/9", "spanning-tree guard root"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/4", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.148", "event_vlan": 40, "mac": "9DA8.5E78.8164", "interfaces": ["TenGigabitEthernet1/1/4", "GigabitEthernet0/23"], "mac_move_count_5min": 50, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/23", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.177", "interface": "GigabitEthernet0/11", "errdisable_cause": "bpduguard", "vlan": 20, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/11", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.150", "event_vlan": 99, "mac": "4F6D.8EA0.2BA9", "interfaces": ["TenGigabitEthernet1/1/3", "GigabitEthernet0/9"], "mac_move_count_5min": 50, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/6", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.117", "event_vlan": 40, "mac": "9F39.1A18.ED9D", "interfaces": ["GigabitEthernet0/6", "GigabitEthernet0/10"], "mac_move_count_5min": 50, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.64", "event_vlan": 50, "tcn_count_10min": 5, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/22", "last_tcn_port": "GigabitEthernet0/23", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/23", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.246", "event_vlan": 10, "mac": "991A.ADEB.0DCA", "interfaces": ["GigabitEthernet0/7", "GigabitEthernet0/24"], "mac_move_count_5min": 120, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/7", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/3", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.86", "event_vlan": 99, "mac": "C7DC.1EE0.5F56", "interfaces": ["TenGigabitEthernet1/1/3", "GigabitEthernet0/17"], "mac_move_count_5min": 50, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/17", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/3", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.11", "event_vlan": 10, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/17", "last_tcn_port": "GigabitEthernet0/17", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 10 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.194", "interface": "GigabitEthernet0/2", "errdisable_cause": "storm-control", "vlan": 20, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/2", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/12", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.56", "event_vlan": 10, "mac": "7CE7.1941.B650", "interfaces": ["GigabitEthernet0/7", "GigabitEthernet0/12"], "mac_move_count_5min": 300, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.36", "event_vlan": 50, "mac": "09FE.D808.15DC", "interfaces": ["GigabitEthernet0/19", "GigabitEthernet0/15"], "mac_move_count_5min": 120, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.52", "event_vlan": 99, "mac": "D67C.FF5A.C227", "interfaces": ["GigabitEthernet0/4", "GigabitEthernet0/1"], "mac_move_count_5min": 50, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.185", "event_vlan": 20, "tcn_count_10min": 20, "root_bridge_vlan": 20, "root_port": "TenGigabitEthernet1/1/2", "last_tcn_port": "GigabitEthernet0/16", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.22", "interface": "GigabitEthernet0/10", "errdisable_cause": "link-flap", "vlan": 99, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.42", "interface": "TenGigabitEthernet1/1/2", "errdisable_cause": "link-flap", "vlan": 20, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/4", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.219", "event_vlan": 30, "mac": "F8A4.03E1.470D", "interfaces": ["GigabitEthernet0/24", "GigabitEthernet0/4"], "mac_move_count_5min": 20, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/4", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.234", "event_vlan": 10, "tcn_count_10min": 5, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/4", "last_tcn_port": "GigabitEthernet0/4", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 10 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/23", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.30", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/4", "last_tcn_port": "GigabitEthernet0/4", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/4", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.57", "event_vlan": 10, "mac": "9002.FE30.4F5A", "interfaces": ["GigabitEthernet0/18", "TenGigabitEthernet1/1/4"], "mac_move_count_5min": 120, "possible_causes": "bridge"}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.225", "event_vlan": 30, "mac": "C338.4683.15AE", "interfaces": ["GigabitEthernet0/15", "GigabitEthernet0/19"], "mac_move_count_5min": 50, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/19", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.177", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/11", "last_tcn_port": "GigabitEthernet0/11", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/20", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.47", "event_vlan": 50, "tcn_count_10min": 5, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 50 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.15", "event_vlan": 20, "mac": "F026.0793.80CD", "interfaces": ["GigabitEthernet0/12", "GigabitEthernet0/8"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/8", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.242", "interface": "GigabitEthernet0/23", "errdisable_cause": "storm-control", "vlan": 30, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/23", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.122", "interface": "GigabitEthernet0/14", "errdisable_cause": "storm-control", "vlan": 40, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/14", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/3", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.148", "event_vlan": 30, "mac": "9D9D.6255.7E03", "interfaces": ["GigabitEthernet0/14", "TenGigabitEthernet1/1/3"], "mac_move_count_5min": 50, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/14", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.83", "interface": "GigabitEthernet0/22", "errdisable_cause": "storm-control", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/22", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.203", "event_vlan": 99, "mac": "7B3C.9D4C.E301", "interfaces": ["GigabitEthernet0/13", "GigabitEthernet0/3"], "mac_move_count_5min": 120, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/13", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/21", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.137", "interface": "GigabitEthernet0/21", "errdisable_cause": "storm-control", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/21", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "TenGigabitEthernet1/1/4", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.130", "event_vlan": 30, "mac": "EDBD.235C.2B09", "interfaces": ["TenGigabitEthernet1/1/4", "GigabitEthernet0/23"], "mac_move_count_5min": 50, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/23", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/24", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.238", "interface": "GigabitEthernet0/24", "errdisable_cause": "port-security", "vlan": 30, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/24", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.37", "event_vlan": 40, "mac": "6E4E.07CE.ED9E", "interfaces": ["GigabitEthernet0/1", "GigabitEthernet0/11"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.252", "interface": "GigabitEthernet0/24", "errdisable_cause": "bpduguard", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/24", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.57", "interface": "GigabitEthernet0/18", "errdisable_cause": "port-security", "vlan": 30, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/18", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.170", "event_vlan": 10, "tcn_count_10min": 200, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/2", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 10 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/2", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.142", "event_vlan": 40, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/7", "last_tcn_port": "GigabitEthernet0/7", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/16", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.11", "event_vlan": 50, "tcn_count_10min": 5, "root_bridge_vlan": 50, "root_port": "TenGigabitEthernet1/1/4", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/18", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/3", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.58", "event_vlan": 10, "tcn_count_10min": 200, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/2", "last_tcn_port": "GigabitEthernet0/2", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/2", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/4", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.224", "event_vlan": 40, "tcn_count_10min": 60, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/8", "last_tcn_port": "GigabitEthernet0/14", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/20", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.188", "event_vlan": 10, "mac": "1B7B.0B0B.E4DD", "interfaces": ["GigabitEthernet0/12", "GigabitEthernet0/20"], "mac_move_count_5min": 300, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/12", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/1", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.120", "interface": "GigabitEthernet0/1", "errdisable_cause": "port-security", "vlan": 10, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/1", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.189", "event_vlan": 10, "tcn_count_10min": 200, "root_bridge_vlan": 10, "root_port": "TenGigabitEthernet1/1/2", "last_tcn_port": "TenGigabitEthernet1/1/2", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.159", "event_vlan": 20, "mac": "9A77.1CB8.C1C6", "interfaces": ["GigabitEthernet0/3", "GigabitEthernet0/19"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.174", "interface": "GigabitEthernet0/19", "errdisable_cause": "port-security", "vlan": 10, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/19", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/14", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.248", "event_vlan": 20, "mac": "D9AF.FDD9.1BBF", "interfaces": ["GigabitEthernet0/1", "GigabitEthernet0/14"], "mac_move_count_5min": 300, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/14", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.79", "event_vlan": 30, "mac": "B63E.940C.7252", "interfaces": ["GigabitEthernet0/13", "GigabitEthernet0/3"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.185", "event_vlan": 50, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/13", "last_tcn_port": "GigabitEthernet0/13", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/13", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.58", "interface": "GigabitEthernet0/14", "errdisable_cause": "port-security", "vlan": 10, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/14", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.178", "event_vlan": 30, "tcn_count_10min": 60, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/14", "last_tcn_port": "GigabitEthernet0/14", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/14", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.240", "event_vlan": 40, "mac": "F2A0.7894.CC0E", "interfaces": ["GigabitEthernet0/1", "TenGigabitEthernet1/1/1"], "mac_move_count_5min": 20, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/13", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.237", "event_vlan": 20, "mac": "3E42.DA65.4A54", "interfaces": ["GigabitEthernet0/13", "GigabitEthernet0/3"], "mac_move_count_5min": 300, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/3", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/1", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.253", "interface": "GigabitEthernet0/1", "errdisable_cause": "bpduguard", "vlan": 40, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/1", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.118", "event_vlan": 20, "tcn_count_10min": 60, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/7", "last_tcn_port": "GigabitEthernet0/7", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/17", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.147", "event_vlan": 10, "tcn_count_10min": 200, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/1", "last_tcn_port": "TenGigabitEthernet1/1/4", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/18", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.28", "event_vlan": 10, "tcn_count_10min": 200, "root_bridge_vlan": 10, "root_port": "TenGigabitEthernet1/1/1", "last_tcn_port": "GigabitEthernet0/20", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/20", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.47", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/22", "last_tcn_port": "GigabitEthernet0/22", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/22", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.199", "event_vlan": 50, "mac": "833B.F3D4.4E81", "interfaces": ["GigabitEthernet0/9", "TenGigabitEthernet1/1/3"], "mac_move_count_5min": 120, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/4", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.193", "interface": "TenGigabitEthernet1/1/4", "errdisable_cause": "storm-control", "vlan": 30, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/3", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.149", "event_vlan": 50, "mac": "ED3C.7EB2.85BC", "interfaces": ["GigabitEthernet0/3", "TenGigabitEthernet1/1/4"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.67", "interface": "GigabitEthernet0/14", "errdisable_cause": "storm-control", "vlan": 20, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/14", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.231", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/7", "last_tcn_port": "GigabitEthernet0/7", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/7", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/18", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.179", "event_vlan": 99, "mac": "4FA2.73FE.6378", "interfaces": ["GigabitEthernet0/12", "GigabitEthernet0/18"], "mac_move_count_5min": 300, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.141", "event_vlan": 99, "tcn_count_10min": 200, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/24", "last_tcn_port": "GigabitEthernet0/24", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/24", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.230", "event_vlan": 20, "mac": "F85D.1EB8.560C", "interfaces": ["GigabitEthernet0/11", "GigabitEthernet0/21"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.48", "event_vlan": 30, "tcn_count_10min": 20, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/18", "spanning-tree guard root"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.48", "event_vlan": 20, "mac": "B050.5FFD.654F", "interfaces": ["TenGigabitEthernet1/1/1", "GigabitEthernet0/1"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "TenGigabitEthernet1/1/3", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.250", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/23", "last_tcn_port": "TenGigabitEthernet1/1/4", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/3", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.220", "event_vlan": 99, "mac": "2D06.27C2.7374", "interfaces": ["GigabitEthernet0/16", "TenGigabitEthernet1/1/3"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/4", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.250", "event_vlan": 99, "mac": "AC9D.6236.72C1", "interfaces": ["GigabitEthernet0/5", "GigabitEthernet0/4"], "mac_move_count_5min": 50, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/9", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.23", "interface": "GigabitEthernet0/9", "errdisable_cause": "storm-control", "vlan": 50, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/3", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.244", "interface": "TenGigabitEthernet1/1/3", "errdisable_cause": "port-security", "vlan": 10, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/1", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.44", "event_vlan": 10, "tcn_count_10min": 200, "root_bridge_vlan": 10, "root_port": "TenGigabitEthernet1/1/3", "last_tcn_port": "TenGigabitEthernet1/1/3", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.246", "interface": "GigabitEthernet0/21", "errdisable_cause": "udld", "vlan": 20, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/21", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/18", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.61", "event_vlan": 30, "tcn_count_10min": 60, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/5", "last_tcn_port": "GigabitEthernet0/8", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/8", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.113", "event_vlan": 10, "mac": "1734.B912.1EC4", "interfaces": ["GigabitEthernet0/7", "GigabitEthernet0/4"], "mac_move_count_5min": 300, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/14", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.11", "interface": "GigabitEthernet0/14", "errdisable_cause": "udld", "vlan": 10, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/14", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/2", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.47", "event_vlan": 99, "tcn_count_10min": 5, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/22", "last_tcn_port": "GigabitEthernet0/22", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/11", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.222", "event_vlan": 99, "tcn_count_10min": 20, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/8", "last_tcn_port": "GigabitEthernet0/8", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/8", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/7", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.156", "event_vlan": 40, "mac": "9F01.C458.1672", "interfaces": ["TenGigabitEthernet1/1/4", "GigabitEthernet0/7"], "mac_move_count_5min": 300, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.36", "event_vlan": 50, "tcn_count_10min": 60, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/21", "last_tcn_port": "GigabitEthernet0/21", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 50 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.243", "interface": "GigabitEthernet0/24", "errdisable_cause": "storm-control", "vlan": 50, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/24", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/24", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.103", "event_vlan": 50, "mac": "6229.005C.347F", "interfaces": ["TenGigabitEthernet1/1/2", "GigabitEthernet0/24"], "mac_move_count_5min": 20, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/24", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.202", "event_vlan": 10, "mac": "F19E.1243.5796", "interfaces": ["GigabitEthernet0/13", "TenGigabitEthernet1/1/3"], "mac_move_count_5min": 50, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/13", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/8", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.241", "event_vlan": 50, "tcn_count_10min": 200, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/15", "last_tcn_port": "GigabitEthernet0/15", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/15", "spanning-tree guard root"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/20", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.64", "event_vlan": 40, "mac": "C35F.73E4.88AB", "interfaces": ["GigabitEthernet0/20", "GigabitEthernet0/4"], "mac_move_count_5min": 50, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/20", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/2", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.33", "event_vlan": 10, "mac": "35A1.E229.C5B8", "interfaces": ["GigabitEthernet0/19", "GigabitEthernet0/2"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/19", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.43", "event_vlan": 50, "tcn_count_10min": 20, "root_bridge_vlan": 40, "root_port": "TenGigabitEthernet1/1/4", "last_tcn_port": "GigabitEthernet0/20", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/20", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.70", "event_vlan": 40, "mac": "BB0C.7C53.EEC2", "interfaces": ["GigabitEthernet0/8", "GigabitEthernet0/10"], "mac_move_count_5min": 300, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.135", "event_vlan": 99, "mac": "CA39.5047.62A4", "interfaces": ["GigabitEthernet0/9", "GigabitEthernet0/12"], "mac_move_count_5min": 300, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.88", "event_vlan": 20, "mac": "8F29.4E15.8563", "interfaces": ["GigabitEthernet0/15", "GigabitEthernet0/13"], "mac_move_count_5min": 20, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/3", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.160", "event_vlan": 30, "mac": "8C98.6253.7FF7", "interfaces": ["TenGigabitEthernet1/1/3", "GigabitEthernet0/17"], "mac_move_count_5min": 50, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/1", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.44", "event_vlan": 30, "tcn_count_10min": 200, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/2", "last_tcn_port": "GigabitEthernet0/11", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/11", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.25", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/16", "last_tcn_port": "GigabitEthernet0/16", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/16", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.82", "event_vlan": 30, "mac": "C96A.3622.49E5", "interfaces": ["GigabitEthernet0/14", "GigabitEthernet0/18"], "mac_move_count_5min": 300, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/14", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.21", "event_vlan": 10, "tcn_count_10min": 200, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/13", "last_tcn_port": "GigabitEthernet0/13", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/13", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.77", "event_vlan": 50, "mac": "32B8.63E0.86E4", "interfaces": ["GigabitEthernet0/1", "GigabitEthernet0/8"], "mac_move_count_5min": 120, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.168", "event_vlan": 50, "mac": "AA9E.5382.FBCF", "interfaces": ["GigabitEthernet0/19", "GigabitEthernet0/6"], "mac_move_count_5min": 20, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.122", "event_vlan": 30, "tcn_count_10min": 200, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/19", "last_tcn_port": "GigabitEthernet0/19", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/19", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.140", "event_vlan": 10, "tcn_count_10min": 60, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/23", "last_tcn_port": "GigabitEthernet0/23", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/23", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.12", "interface": "GigabitEthernet0/24", "errdisable_cause": "udld", "vlan": 50, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/24", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/4", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.121", "event_vlan": 20, "tcn_count_10min": 60, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/9", "last_tcn_port": "GigabitEthernet0/5", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/5", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.171", "event_vlan": 50, "mac": "9D07.9F92.8E4B", "interfaces": ["GigabitEthernet0/1", "GigabitEthernet0/18"], "mac_move_count_5min": 20, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/4", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.58", "event_vlan": 20, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/15", "last_tcn_port": "TenGigabitEthernet1/1/4", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.122", "event_vlan": 99, "tcn_count_10min": 200, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/14", "last_tcn_port": "GigabitEthernet0/14", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/14", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.134", "event_vlan": 20, "tcn_count_10min": 60, "root_bridge_vlan": 40, "root_port": "TenGigabitEthernet1/1/3", "last_tcn_port": "TenGigabitEthernet1/1/3", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.203", "interface": "GigabitEthernet0/22", "errdisable_cause": "storm-control", "vlan": 99, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/22", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.150", "event_vlan": 40, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/11", "last_tcn_port": "GigabitEthernet0/11", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.203", "event_vlan": 50, "mac": "A720.09D0.E73E", "interfaces": ["GigabitEthernet0/21", "GigabitEthernet0/6"], "mac_move_count_5min": 300, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/21", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.75", "event_vlan": 20, "tcn_count_10min": 60, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/17", "last_tcn_port": "GigabitEthernet0/17", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.14", "event_vlan": 99, "mac": "1D3D.9133.4AD0", "interfaces": ["GigabitEthernet0/14", "GigabitEthernet0/16"], "mac_move_count_5min": 50, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/16", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/23", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.43", "event_vlan": 30, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "TenGigabitEthernet1/1/1", "last_tcn_port": "TenGigabitEthernet1/1/1", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.137", "event_vlan": 50, "mac": "76FE.BB4B.66B3", "interfaces": ["TenGigabitEthernet1/1/4", "GigabitEthernet0/17"], "mac_move_count_5min": 20, "possible_causes": "bridge"}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.241", "event_vlan": 99, "tcn_count_10min": 200, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/15", "last_tcn_port": "GigabitEthernet0/13", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/13", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.114", "event_vlan": 40, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/10", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.89", "interface": "GigabitEthernet0/8", "errdisable_cause": "port-security", "vlan": 50, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/8", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "TenGigabitEthernet1/1/4", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.161", "event_vlan": 40, "tcn_count_10min": 20, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/3", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.89", "interface": "GigabitEthernet0/16", "errdisable_cause": "storm-control", "vlan": 30, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/16", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.13", "event_vlan": 50, "tcn_count_10min": 200, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/22", "last_tcn_port": "GigabitEthernet0/22", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/5", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.224", "event_vlan": 20, "mac": "9CE0.37EF.4587", "interfaces": ["GigabitEthernet0/5", "GigabitEthernet0/3"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.184", "event_vlan": 50, "tcn_count_10min": 20, "root_bridge_vlan": 50, "root_port": "TenGigabitEthernet1/1/2", "last_tcn_port": "TenGigabitEthernet1/1/2", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 50 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.141", "event_vlan": 20, "mac": "8574.1C86.ECFE", "interfaces": ["GigabitEthernet0/1", "GigabitEthernet0/24"], "mac_move_count_5min": 50, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/24", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.173", "interface": "GigabitEthernet0/24", "errdisable_cause": "udld", "vlan": 20, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/24", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.111", "event_vlan": 99, "tcn_count_10min": 200, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/9", "last_tcn_port": "GigabitEthernet0/11", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/1", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.247", "interface": "TenGigabitEthernet1/1/1", "errdisable_cause": "port-security", "vlan": 50, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.226", "event_vlan": 40, "mac": "FA3B.F611.3034", "interfaces": ["GigabitEthernet0/7", "GigabitEthernet0/14"], "mac_move_count_5min": 20, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.220", "event_vlan": 30, "mac": "C741.1D34.3A19", "interfaces": ["GigabitEthernet0/16", "GigabitEthernet0/14"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/14", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/24", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.159", "event_vlan": 40, "tcn_count_10min": 20, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/15", "last_tcn_port": "GigabitEthernet0/15", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/15", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.153", "interface": "GigabitEthernet0/18", "errdisable_cause": "link-flap", "vlan": 20, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.192", "event_vlan": 10, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/19", "last_tcn_port": "GigabitEthernet0/19", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/19", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/3", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.185", "event_vlan": 20, "mac": "766C.16B9.FE5E", "interfaces": ["GigabitEthernet0/3", "GigabitEthernet0/2"], "mac_move_count_5min": 20, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/2", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.130", "interface": "GigabitEthernet0/20", "errdisable_cause": "storm-control", "vlan": 99, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/20", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/4", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.45", "interface": "GigabitEthernet0/4", "errdisable_cause": "link-flap", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/4", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.124", "event_vlan": 99, "mac": "25A6.7D92.D6FF", "interfaces": ["TenGigabitEthernet1/1/4", "GigabitEthernet0/1"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.30", "event_vlan": 50, "tcn_count_10min": 200, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/11", "last_tcn_port": "GigabitEthernet0/11", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/11", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.81", "event_vlan": 99, "tcn_count_10min": 200, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/5", "last_tcn_port": "TenGigabitEthernet1/1/2", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.108", "event_vlan": 99, "tcn_count_10min": 200, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/16", "last_tcn_port": "GigabitEthernet0/16", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 99 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/5", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.46", "event_vlan": 20, "tcn_count_10min": 20, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.28", "event_vlan": 30, "tcn_count_10min": 60, "root_bridge_vlan": 30, "root_port": "TenGigabitEthernet1/1/4", "last_tcn_port": "TenGigabitEthernet1/1/4", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/7", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.141", "event_vlan": 50, "mac": "747A.C603.241F", "interfaces": ["GigabitEthernet0/1", "GigabitEthernet0/7"], "mac_move_count_5min": 20, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.100", "interface": "GigabitEthernet0/2", "errdisable_cause": "port-security", "vlan": 10, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/2", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.37", "event_vlan": 30, "tcn_count_10min": 200, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/9", "last_tcn_port": "GigabitEthernet0/9", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 30 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.55", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "TenGigabitEthernet1/1/4", "last_tcn_port": "GigabitEthernet0/13", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 20 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/4", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.105", "event_vlan": 10, "mac": "18A7.E6CE.A989", "interfaces": ["GigabitEthernet0/4", "GigabitEthernet0/24"], "mac_move_count_5min": 120, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/24", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.202", "interface": "GigabitEthernet0/7", "errdisable_cause": "storm-control", "vlan": 20, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/7", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.234", "interface": "GigabitEthernet0/8", "errdisable_cause": "udld", "vlan": 99, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/8", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.113", "interface": "GigabitEthernet0/20", "errdisable_cause": "bpduguard", "vlan": 40, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/20", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.165", "event_vlan": 40, "tcn_count_10min": 60, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/4", "last_tcn_port": "GigabitEthernet0/15", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.172", "event_vlan": 10, "mac": "3549.5BE0.A188", "interfaces": ["GigabitEthernet0/13", "GigabitEthernet0/15"], "mac_move_count_5min": 50, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/13", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.155", "event_vlan": 20, "mac": "750D.1C42.F38E", "interfaces": ["GigabitEthernet0/9", "GigabitEthernet0/7"], "mac_move_count_5min": 120, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/17", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.80", "event_vlan": 30, "tcn_count_10min": 5, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/13", "last_tcn_port": "GigabitEthernet0/14", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/14", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.162", "interface": "TenGigabitEthernet1/1/2", "errdisable_cause": "link-flap", "vlan": 30, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.54", "event_vlan": 30, "tcn_count_10min": 60, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/22", "last_tcn_port": "GigabitEthernet0/22", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/16", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.211", "event_vlan": 10, "mac": "7736.B89F.687E", "interfaces": ["GigabitEthernet0/21", "GigabitEthernet0/16"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/21", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.88", "event_vlan": 40, "mac": "C190.26D6.F3FA", "interfaces": ["GigabitEthernet0/20", "GigabitEthernet0/24"], "mac_move_count_5min": 50, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/20", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.9", "interface": "GigabitEthernet0/21", "errdisable_cause": "bpduguard", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/21", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.89", "event_vlan": 30, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/6", "last_tcn_port": "GigabitEthernet0/10", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.62", "event_vlan": 10, "mac": "FC07.1E4C.917E", "interfaces": ["GigabitEthernet0/5", "GigabitEthernet0/22"], "mac_move_count_5min": 50, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/22", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.124", "event_vlan": 99, "tcn_count_10min": 60, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/23", "last_tcn_port": "GigabitEthernet0/23", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/23", "spanning-tree guard root"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.84", "event_vlan": 10, "mac": "BFE1.94CB.BFD2", "interfaces": ["GigabitEthernet0/24", "GigabitEthernet0/2"], "mac_move_count_5min": 50, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/24", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.247", "interface": "GigabitEthernet0/4", "errdisable_cause": "link-flap", "vlan": 30, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/7", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.159", "event_vlan": 20, "mac": "8BBF.D1B4.41A6", "interfaces": ["GigabitEthernet0/7", "GigabitEthernet0/5"], "mac_move_count_5min": 120, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "TenGigabitEthernet1/1/4", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.243", "event_vlan": 40, "mac": "54CB.7303.83CA", "interfaces": ["TenGigabitEthernet1/1/4", "GigabitEthernet0/16"], "mac_move_count_5min": 20, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/21", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.239", "interface": "GigabitEthernet0/21", "errdisable_cause": "link-flap", "vlan": 10, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.57", "interface": "GigabitEthernet0/10", "errdisable_cause": "port-security", "vlan": 40, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/10", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.132", "event_vlan": 99, "tcn_count_10min": 20, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/24", "last_tcn_port": "GigabitEthernet0/13", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/13", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.87", "interface": "GigabitEthernet0/23", "errdisable_cause": "bpduguard", "vlan": 30, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/23", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.216", "event_vlan": 50, "tcn_count_10min": 200, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/18", "last_tcn_port": "TenGigabitEthernet1/1/3", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.17", "event_vlan": 40, "tcn_count_10min": 20, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/2", "last_tcn_port": "GigabitEthernet0/2", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.42", "event_vlan": 20, "tcn_count_10min": 200, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/22", "last_tcn_port": "GigabitEthernet0/22", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/22", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/13", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.154", "event_vlan": 40, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/20", "last_tcn_port": "GigabitEthernet0/20", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.144", "event_vlan": 50, "mac": "2521.73BF.AA6D", "interfaces": ["GigabitEthernet0/11", "GigabitEthernet0/24"], "mac_move_count_5min": 20, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.6", "event_vlan": 10, "tcn_count_10min": 20, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/7", "last_tcn_port": "GigabitEthernet0/13", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/13", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/19", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.172", "interface": "GigabitEthernet0/19", "errdisable_cause": "storm-control", "vlan": 20, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/4", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.216", "interface": "TenGigabitEthernet1/1/4", "errdisable_cause": "storm-control", "vlan": 30, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.40", "event_vlan": 50, "mac": "E445.BF44.9506", "interfaces": ["GigabitEthernet0/21", "GigabitEthernet0/23"], "mac_move_count_5min": 50, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/23", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.46", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "TenGigabitEthernet1/1/2", "last_tcn_port": "TenGigabitEthernet1/1/2", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.199", "event_vlan": 40, "tcn_count_10min": 20, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/11", "last_tcn_port": "TenGigabitEthernet1/1/1", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.139", "event_vlan": 50, "tcn_count_10min": 20, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/18", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/4", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.211", "event_vlan": 40, "tcn_count_10min": 60, "root_bridge_vlan": 50, "root_port": "TenGigabitEthernet1/1/3", "last_tcn_port": "TenGigabitEthernet1/1/3", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/20", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.148", "event_vlan": 20, "mac": "9F71.6BEC.FE80", "interfaces": ["GigabitEthernet0/15", "GigabitEthernet0/20"], "mac_move_count_5min": 50, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/20", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.40", "interface": "GigabitEthernet0/1", "errdisable_cause": "link-flap", "vlan": 50, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.244", "event_vlan": 20, "tcn_count_10min": 200, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/11", "last_tcn_port": "GigabitEthernet0/11", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/9", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.90", "event_vlan": 10, "mac": "ABED.70EE.BAEA", "interfaces": ["GigabitEthernet0/15", "GigabitEthernet0/9"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.145", "event_vlan": 10, "mac": "5F83.3B5F.B406", "interfaces": ["GigabitEthernet0/22", "GigabitEthernet0/24"], "mac_move_count_5min": 50, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/22", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/21", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.203", "interface": "GigabitEthernet0/21", "errdisable_cause": "port-security", "vlan": 30, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/21", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.113", "interface": "GigabitEthernet0/4", "errdisable_cause": "storm-control", "vlan": 20, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/4", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.203", "event_vlan": 40, "mac": "1E7C.843D.AD06", "interfaces": ["GigabitEthernet0/10", "GigabitEthernet0/12"], "mac_move_count_5min": 50, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/12", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.152", "event_vlan": 50, "tcn_count_10min": 60, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/10", "last_tcn_port": "GigabitEthernet0/15", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/18", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.228", "event_vlan": 99, "mac": "E6CA.1AF4.523A", "interfaces": ["GigabitEthernet0/18", "GigabitEthernet0/8"], "mac_move_count_5min": 20, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/18", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.63", "event_vlan": 50, "mac": "A88F.972A.D46A", "interfaces": ["GigabitEthernet0/18", "GigabitEthernet0/7"], "mac_move_count_5min": 50, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.20", "interface": "GigabitEthernet0/24", "errdisable_cause": "port-security", "vlan": 50, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/24", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/9", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.176", "event_vlan": 10, "mac": "D995.2D16.B8C4", "interfaces": ["GigabitEthernet0/9", "GigabitEthernet0/2"], "mac_move_count_5min": 120, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/2", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.193", "event_vlan": 99, "mac": "1701.D0ED.BF8F", "interfaces": ["TenGigabitEthernet1/1/1", "TenGigabitEthernet1/1/2"], "mac_move_count_5min": 20, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.168", "interface": "GigabitEthernet0/11", "errdisable_cause": "port-security", "vlan": 30, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/11", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.149", "event_vlan": 50, "mac": "1B21.2A3C.C4C0", "interfaces": ["GigabitEthernet0/12", "GigabitEthernet0/24"], "mac_move_count_5min": 300, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/6", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.215", "event_vlan": 99, "mac": "5FCA.0436.7AE3", "interfaces": ["GigabitEthernet0/6", "GigabitEthernet0/15"], "mac_move_count_5min": 300, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/6", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/4", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.203", "interface": "TenGigabitEthernet1/1/4", "errdisable_cause": "storm-control", "vlan": 20, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/1", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.168", "event_vlan": 10, "mac": "747E.0920.53B4", "interfaces": ["TenGigabitEthernet1/1/1", "GigabitEthernet0/5"], "mac_move_count_5min": 300, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.95", "event_vlan": 10, "mac": "AB8B.374D.7305", "interfaces": ["GigabitEthernet0/1", "GigabitEthernet0/17"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/17", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.219", "event_vlan": 50, "mac": "838F.9946.F2F8", "interfaces": ["GigabitEthernet0/14", "GigabitEthernet0/2"], "mac_move_count_5min": 120, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/14", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.158", "event_vlan": 99, "mac": "4877.CA11.EC6A", "interfaces": ["GigabitEthernet0/7", "GigabitEthernet0/13"], "mac_move_count_5min": 120, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/7", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.22", "event_vlan": 99, "mac": "2DF6.CF37.4E5A", "interfaces": ["GigabitEthernet0/14", "TenGigabitEthernet1/1/1"], "mac_move_count_5min": 120, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.20", "event_vlan": 30, "mac": "D9B7.B721.A795", "interfaces": ["GigabitEthernet0/1", "GigabitEthernet0/15"], "mac_move_count_5min": 120, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/4", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.101", "event_vlan": 10, "tcn_count_10min": 200, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/9", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 10 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.69", "event_vlan": 10, "tcn_count_10min": 60, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/9", "last_tcn_port": "GigabitEthernet0/9", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/9", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "TenGigabitEthernet1/1/2", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.155", "interface": "TenGigabitEthernet1/1/2", "errdisable_cause": "port-security", "vlan": 30, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.130", "interface": "GigabitEthernet0/3", "errdisable_cause": "port-security", "vlan": 10, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/3", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.77", "event_vlan": 40, "mac": "3CE0.5B99.6C7D", "interfaces": ["GigabitEthernet0/19", "GigabitEthernet0/10"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.122", "interface": "GigabitEthernet0/18", "errdisable_cause": "bpduguard", "vlan": 20, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/18", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.142", "event_vlan": 40, "tcn_count_10min": 60, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/10", "last_tcn_port": "GigabitEthernet0/10", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/10", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.216", "interface": "GigabitEthernet0/22", "errdisable_cause": "bpduguard", "vlan": 20, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/22", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.148", "interface": "GigabitEthernet0/6", "errdisable_cause": "bpduguard", "vlan": 99, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/6", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.94", "event_vlan": 30, "mac": "FB0A.75E8.66F8", "interfaces": ["GigabitEthernet0/19", "GigabitEthernet0/10"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/19", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.141", "event_vlan": 40, "mac": "B782.126A.A9E3", "interfaces": ["GigabitEthernet0/7", "GigabitEthernet0/8"], "mac_move_count_5min": 120, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/8", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.38", "interface": "GigabitEthernet0/10", "errdisable_cause": "port-security", "vlan": 40, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/10", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/1", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.92", "interface": "TenGigabitEthernet1/1/1", "errdisable_cause": "port-security", "vlan": 40, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.55", "event_vlan": 30, "mac": "8C32.4965.753A", "interfaces": ["GigabitEthernet0/21", "GigabitEthernet0/8"], "mac_move_count_5min": 50, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/8", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/1", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.117", "event_vlan": 40, "mac": "897A.B69B.EABC", "interfaces": ["TenGigabitEthernet1/1/1", "GigabitEthernet0/24"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.102", "event_vlan": 40, "mac": "5269.2922.809F", "interfaces": ["TenGigabitEthernet1/1/2", "GigabitEthernet0/9"], "mac_move_count_5min": 120, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/9", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "TenGigabitEthernet1/1/3", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.142", "interface": "TenGigabitEthernet1/1/3", "errdisable_cause": "link-flap", "vlan": 10, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.155", "event_vlan": 30, "tcn_count_10min": 60, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/12", "last_tcn_port": "GigabitEthernet0/9", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 30 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.201", "event_vlan": 10, "mac": "AAA8.8B74.0FA3", "interfaces": ["GigabitEthernet0/24", "GigabitEthernet0/10"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/24", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.42", "interface": "GigabitEthernet0/18", "errdisable_cause": "port-security", "vlan": 30, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/18", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.163", "interface": "GigabitEthernet0/8", "errdisable_cause": "bpduguard", "vlan": 50, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/8", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/3", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.74", "event_vlan": 50, "mac": "BD58.534F.DE8A", "interfaces": ["GigabitEthernet0/3", "GigabitEthernet0/15"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.196", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/14", "last_tcn_port": "GigabitEthernet0/14", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.229", "event_vlan": 50, "tcn_count_10min": 200, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/14", "last_tcn_port": "GigabitEthernet0/14", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 50 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.123", "event_vlan": 10, "tcn_count_10min": 200, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/11", "last_tcn_port": "GigabitEthernet0/21", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/21", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.203", "event_vlan": 30, "mac": "2CD5.3248.78D6", "interfaces": ["GigabitEthernet0/24", "TenGigabitEthernet1/1/3"], "mac_move_count_5min": 300, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.217", "interface": "GigabitEthernet0/4", "errdisable_cause": "link-flap", "vlan": 30, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/3", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.240", "event_vlan": 99, "tcn_count_10min": 60, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/7", "last_tcn_port": "GigabitEthernet0/7", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/7", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/15", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.45", "interface": "GigabitEthernet0/15", "errdisable_cause": "udld", "vlan": 40, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/15", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/21", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.129", "event_vlan": 20, "tcn_count_10min": 60, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/23", "last_tcn_port": "GigabitEthernet0/23", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/23", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/1", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.142", "event_vlan": 30, "tcn_count_10min": 20, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/24", "last_tcn_port": "TenGigabitEthernet1/1/1", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.232", "event_vlan": 50, "tcn_count_10min": 60, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/11", "last_tcn_port": "GigabitEthernet0/11", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/11", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.49", "event_vlan": 50, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/17", "last_tcn_port": "GigabitEthernet0/17", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 50 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.86", "interface": "GigabitEthernet0/3", "errdisable_cause": "storm-control", "vlan": 30, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/3", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.248", "interface": "GigabitEthernet0/4", "errdisable_cause": "port-security", "vlan": 10, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/4", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/7", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.222", "event_vlan": 20, "mac": "9E28.BA0D.EC9B", "interfaces": ["GigabitEthernet0/7", "GigabitEthernet0/19"], "mac_move_count_5min": 20, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.253", "event_vlan": 99, "tcn_count_10min": 60, "root_bridge_vlan": 99, "root_port": "TenGigabitEthernet1/1/4", "last_tcn_port": "TenGigabitEthernet1/1/4", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 99 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.238", "event_vlan": 99, "tcn_count_10min": 5, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/20", "last_tcn_port": "GigabitEthernet0/8", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/8", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.187", "interface": "GigabitEthernet0/15", "errdisable_cause": "bpduguard", "vlan": 30, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/15", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.139", "interface": "GigabitEthernet0/7", "errdisable_cause": "port-security", "vlan": 30, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/7", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.159", "event_vlan": 30, "tcn_count_10min": 5, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/5", "last_tcn_port": "GigabitEthernet0/5", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 30 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.143", "event_vlan": 50, "mac": "6FC3.DD7A.4D18", "interfaces": ["GigabitEthernet0/16", "GigabitEthernet0/13"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/13", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.53", "interface": "GigabitEthernet0/23", "errdisable_cause": "udld", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/23", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/9", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.80", "interface": "GigabitEthernet0/9", "errdisable_cause": "udld", "vlan": 20, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/4", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.15", "event_vlan": 20, "mac": "EA72.DC65.72CA", "interfaces": ["GigabitEthernet0/2", "GigabitEthernet0/4"], "mac_move_count_5min": 50, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/4", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.48", "event_vlan": 10, "tcn_count_10min": 5, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/13", "last_tcn_port": "GigabitEthernet0/4", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/4", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/1", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.2", "event_vlan": 99, "tcn_count_10min": 60, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/21", "last_tcn_port": "GigabitEthernet0/21", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/21", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "TenGigabitEthernet1/1/3", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.254", "event_vlan": 20, "tcn_count_10min": 200, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/21", "last_tcn_port": "GigabitEthernet0/21", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/21", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.213", "event_vlan": 20, "tcn_count_10min": 200, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/23", "last_tcn_port": "GigabitEthernet0/23", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/23", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/14", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.149", "event_vlan": 20, "mac": "10A5.2AE7.135A", "interfaces": ["GigabitEthernet0/14", "TenGigabitEthernet1/1/1"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/18", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.9", "interface": "GigabitEthernet0/18", "errdisable_cause": "port-security", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/18", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/17", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.203", "interface": "GigabitEthernet0/17", "errdisable_cause": "link-flap", "vlan": 30, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.83", "event_vlan": 40, "tcn_count_10min": 20, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/15", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/15", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.66", "event_vlan": 20, "tcn_count_10min": 200, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/21", "last_tcn_port": "GigabitEthernet0/21", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/21", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/13", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.145", "event_vlan": 50, "tcn_count_10min": 20, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/20", "last_tcn_port": "GigabitEthernet0/12", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/12", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.154", "event_vlan": 30, "tcn_count_10min": 20, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/12", "last_tcn_port": "GigabitEthernet0/12", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.195", "event_vlan": 50, "mac": "F27A.95E3.DF0D", "interfaces": ["GigabitEthernet0/1", "GigabitEthernet0/18"], "mac_move_count_5min": 20, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "TenGigabitEthernet1/1/3", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.114", "interface": "TenGigabitEthernet1/1/3", "errdisable_cause": "storm-control", "vlan": 10, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.128", "event_vlan": 50, "tcn_count_10min": 200, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/9", "last_tcn_port": "GigabitEthernet0/9", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.70", "event_vlan": 20, "tcn_count_10min": 200, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/16", "last_tcn_port": "GigabitEthernet0/20", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/20", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.17", "interface": "GigabitEthernet0/10", "errdisable_cause": "storm-control", "vlan": 30, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/10", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.148", "interface": "GigabitEthernet0/10", "errdisable_cause": "link-flap", "vlan": 20, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/15", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.50", "interface": "GigabitEthernet0/15", "errdisable_cause": "link-flap", "vlan": 20, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/22", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.169", "event_vlan": 99, "tcn_count_10min": 20, "root_bridge_vlan": 99, "root_port": "TenGigabitEthernet1/1/4", "last_tcn_port": "TenGigabitEthernet1/1/4", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 99 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.121", "event_vlan": 30, "tcn_count_10min": 200, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/18", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.80", "event_vlan": 40, "mac": "BB71.50EB.CE0E", "interfaces": ["TenGigabitEthernet1/1/4", "GigabitEthernet0/21"], "mac_move_count_5min": 120, "possible_causes": "bridge"}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/20", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.221", "interface": "GigabitEthernet0/20", "errdisable_cause": "udld", "vlan": 50, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/20", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.72", "event_vlan": 50, "tcn_count_10min": 5, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/23", "last_tcn_port": "GigabitEthernet0/23", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 50 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/14", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.241", "event_vlan": 50, "tcn_count_10min": 5, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/19", "last_tcn_port": "GigabitEthernet0/8", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/8", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.99", "event_vlan": 40, "mac": "4120.2950.AB0D", "interfaces": ["GigabitEthernet0/17", "GigabitEthernet0/4"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.173", "event_vlan": 40, "mac": "BCA2.E9A5.509C", "interfaces": ["GigabitEthernet0/23", "GigabitEthernet0/24"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/23", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/9", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.152", "event_vlan": 10, "mac": "9FA2.1F53.6199", "interfaces": ["GigabitEthernet0/3", "GigabitEthernet0/9"], "mac_move_count_5min": 20, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/9", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.218", "event_vlan": 10, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/16", "last_tcn_port": "GigabitEthernet0/16", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.51", "event_vlan": 40, "tcn_count_10min": 20, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/16", "last_tcn_port": "GigabitEthernet0/4", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/4", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.124", "event_vlan": 40, "tcn_count_10min": 20, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/21", "last_tcn_port": "GigabitEthernet0/21", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/21", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/2", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.197", "interface": "TenGigabitEthernet1/1/2", "errdisable_cause": "bpduguard", "vlan": 99, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/1", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.97", "event_vlan": 10, "mac": "504F.F38B.4D85", "interfaces": ["TenGigabitEthernet1/1/3", "TenGigabitEthernet1/1/1"], "mac_move_count_5min": 300, "possible_causes": "loop"}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.69", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/11", "last_tcn_port": "TenGigabitEthernet1/1/1", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "spanning-tree guard root"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/4", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.50", "event_vlan": 30, "mac": "3F7B.D44C.B02E", "interfaces": ["GigabitEthernet0/4", "GigabitEthernet0/9"], "mac_move_count_5min": 120, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.88", "event_vlan": 10, "tcn_count_10min": 60, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/5", "last_tcn_port": "GigabitEthernet0/5", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.213", "event_vlan": 99, "mac": "4FA3.3C3D.B4D5", "interfaces": ["GigabitEthernet0/12", "GigabitEthernet0/6"], "mac_move_count_5min": 50, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.87", "interface": "GigabitEthernet0/20", "errdisable_cause": "link-flap", "vlan": 99, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/20", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.64", "event_vlan": 20, "tcn_count_10min": 200, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/20", "last_tcn_port": "GigabitEthernet0/20", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 20 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/5", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.15", "interface": "GigabitEthernet0/5", "errdisable_cause": "udld", "vlan": 30, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/5", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.237", "event_vlan": 50, "mac": "6FA9.D354.905D", "interfaces": ["GigabitEthernet0/13", "GigabitEthernet0/22"], "mac_move_count_5min": 300, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/9", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.203", "event_vlan": 10, "mac": "A2CC.1F83.BD32", "interfaces": ["GigabitEthernet0/9", "GigabitEthernet0/24"], "mac_move_count_5min": 300, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.235", "event_vlan": 99, "mac": "FD26.60B4.A798", "interfaces": ["GigabitEthernet0/1", "TenGigabitEthernet1/1/2"], "mac_move_count_5min": 300, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.114", "interface": "GigabitEthernet0/2", "errdisable_cause": "bpduguard", "vlan": 40, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/2", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/24", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.242", "event_vlan": 30, "tcn_count_10min": 5, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/6", "last_tcn_port": "GigabitEthernet0/6", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 30 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.199", "interface": "GigabitEthernet0/20", "errdisable_cause": "bpduguard", "vlan": 20, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/20", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.56", "event_vlan": 99, "mac": "F641.8EBD.6C11", "interfaces": ["GigabitEthernet0/12", "GigabitEthernet0/23"], "mac_move_count_5min": 20, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/3", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.247", "event_vlan": 50, "mac": "0968.2988.A6EA", "interfaces": ["TenGigabitEthernet1/1/1", "TenGigabitEthernet1/1/3"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.200", "event_vlan": 10, "mac": "D64B.92D9.6A36", "interfaces": ["GigabitEthernet0/14", "TenGigabitEthernet1/1/3"], "mac_move_count_5min": 50, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/14", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.221", "event_vlan": 99, "tcn_count_10min": 200, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/21", "last_tcn_port": "GigabitEthernet0/21", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/21", "spanning-tree guard root"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.157", "event_vlan": 99, "mac": "9E26.7D49.5D4F", "interfaces": ["GigabitEthernet0/20", "GigabitEthernet0/3"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/3", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.249", "interface": "GigabitEthernet0/19", "errdisable_cause": "udld", "vlan": 50, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/19", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.236", "event_vlan": 30, "tcn_count_10min": 20, "root_bridge_vlan": 30, "root_port": "TenGigabitEthernet1/1/2", "last_tcn_port": "GigabitEthernet0/17", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 30 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.124", "event_vlan": 40, "mac": "3271.EFD3.3BBB", "interfaces": ["GigabitEthernet0/9", "GigabitEthernet0/4"], "mac_move_count_5min": 20, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/4", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.24", "interface": "GigabitEthernet0/17", "errdisable_cause": "udld", "vlan": 10, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/17", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.209", "event_vlan": 20, "tcn_count_10min": 20, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/17", "last_tcn_port": "GigabitEthernet0/17", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/12", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.185", "event_vlan": 40, "tcn_count_10min": 20, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.143", "interface": "GigabitEthernet0/10", "errdisable_cause": "link-flap", "vlan": 40, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.124", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "TenGigabitEthernet1/1/4", "last_tcn_port": "TenGigabitEthernet1/1/4", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.7", "event_vlan": 10, "mac": "B331.7B73.36D0", "interfaces": ["GigabitEthernet0/15", "GigabitEthernet0/1"], "mac_move_count_5min": 120, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/15", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.120", "event_vlan": 40, "mac": "C33C.9FBF.36B4", "interfaces": ["GigabitEthernet0/8", "GigabitEthernet0/19"], "mac_move_count_5min": 120, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/8", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "TenGigabitEthernet1/1/1", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.185", "interface": "TenGigabitEthernet1/1/1", "errdisable_cause": "storm-control", "vlan": 99, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/9", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.36", "interface": "GigabitEthernet0/9", "errdisable_cause": "bpduguard", "vlan": 20, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/9", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.9", "interface": "GigabitEthernet0/14", "errdisable_cause": "link-flap", "vlan": 40, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/14", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/7", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.129", "event_vlan": 50, "mac": "B03D.8660.B0BE", "interfaces": ["GigabitEthernet0/17", "GigabitEthernet0/7"], "mac_move_count_5min": 300, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.152", "event_vlan": 50, "tcn_count_10min": 20, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/4", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/4", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.83", "event_vlan": 99, "tcn_count_10min": 20, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/5", "last_tcn_port": "GigabitEthernet0/5", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 99 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.51", "interface": "GigabitEthernet0/1", "errdisable_cause": "bpduguard", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/1", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.204", "interface": "GigabitEthernet0/5", "errdisable_cause": "bpduguard", "vlan": 40, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/5", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/4", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.51", "event_vlan": 30, "mac": "8347.D9FD.4CA8", "interfaces": ["GigabitEthernet0/20", "GigabitEthernet0/4"], "mac_move_count_5min": 300, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/4", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/13", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.190", "event_vlan": 50, "tcn_count_10min": 60, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/9", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/18", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.101", "interface": "GigabitEthernet0/23", "errdisable_cause": "link-flap", "vlan": 99, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/23", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.207", "event_vlan": 10, "mac": "D258.129E.1D2E", "interfaces": ["GigabitEthernet0/14", "GigabitEthernet0/3"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/14", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.240", "event_vlan": 10, "mac": "9241.4800.BAAD", "interfaces": ["GigabitEthernet0/22", "GigabitEthernet0/17"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/17", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.79", "event_vlan": 20, "mac": "87F1.3FF1.C7E2", "interfaces": ["GigabitEthernet0/13", "TenGigabitEthernet1/1/2"], "mac_move_count_5min": 300, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/13", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/7", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.143", "interface": "GigabitEthernet0/7", "errdisable_cause": "port-security", "vlan": 10, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/7", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "TenGigabitEthernet1/1/4", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.16", "interface": "TenGigabitEthernet1/1/4", "errdisable_cause": "port-security", "vlan": 40, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/9", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.236", "interface": "GigabitEthernet0/9", "errdisable_cause": "port-security", "vlan": 10, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "TenGigabitEthernet1/1/4", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.63", "event_vlan": 99, "tcn_count_10min": 60, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/8", "last_tcn_port": "GigabitEthernet0/3", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 99 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.136", "interface": "GigabitEthernet0/17", "errdisable_cause": "link-flap", "vlan": 40, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.186", "event_vlan": 20, "mac": "E925.D87E.D62D", "interfaces": ["GigabitEthernet0/11", "GigabitEthernet0/16"], "mac_move_count_5min": 20, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/4", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.250", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/5", "last_tcn_port": "GigabitEthernet0/22", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/22", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.169", "event_vlan": 40, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "TenGigabitEthernet1/1/1", "last_tcn_port": "GigabitEthernet0/8", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/8", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/7", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.100", "event_vlan": 99, "mac": "3FEE.119B.7486", "interfaces": ["GigabitEthernet0/5", "GigabitEthernet0/7"], "mac_move_count_5min": 50, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.124", "event_vlan": 40, "tcn_count_10min": 200, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/13", "last_tcn_port": "GigabitEthernet0/2", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "TenGigabitEthernet1/1/4", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.153", "event_vlan": 10, "mac": "FA66.98C0.0982", "interfaces": ["GigabitEthernet0/6", "TenGigabitEthernet1/1/4"], "mac_move_count_5min": 20, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/6", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.62", "event_vlan": 50, "tcn_count_10min": 20, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/11", "last_tcn_port": "GigabitEthernet0/16", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 50 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/3", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.144", "event_vlan": 99, "mac": "1079.A45F.3941", "interfaces": ["TenGigabitEthernet1/1/3", "GigabitEthernet0/2"], "mac_move_count_5min": 20, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.228", "event_vlan": 99, "tcn_count_10min": 5, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/4", "last_tcn_port": "GigabitEthernet0/4", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.77", "interface": "GigabitEthernet0/5", "errdisable_cause": "port-security", "vlan": 20, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/5", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.186", "event_vlan": 40, "mac": "3DF0.884F.BCDB", "interfaces": ["GigabitEthernet0/10", "GigabitEthernet0/21"], "mac_move_count_5min": 50, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/10", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/13", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.79", "interface": "GigabitEthernet0/13", "errdisable_cause": "udld", "vlan": 50, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/13", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.74", "interface": "GigabitEthernet0/8", "errdisable_cause": "bpduguard", "vlan": 50, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/8", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.183", "interface": "GigabitEthernet0/12", "errdisable_cause": "udld", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/12", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/14", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.16", "event_vlan": 99, "tcn_count_10min": 20, "root_bridge_vlan": 50, "root_port": "TenGigabitEthernet1/1/2", "last_tcn_port": "TenGigabitEthernet1/1/2", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.36", "event_vlan": 10, "mac": "7919.4544.CE06", "interfaces": ["GigabitEthernet0/12", "GigabitEthernet0/3"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.191", "interface": "GigabitEthernet0/13", "errdisable_cause": "bpduguard", "vlan": 50, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/13", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.169", "event_vlan": 20, "tcn_count_10min": 60, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/22", "last_tcn_port": "GigabitEthernet0/15", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/15", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/4", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.244", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/5", "last_tcn_port": "GigabitEthernet0/22", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/22", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.236", "interface": "GigabitEthernet0/6", "errdisable_cause": "storm-control", "vlan": 20, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/6", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.150", "event_vlan": 40, "tcn_count_10min": 20, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/10", "last_tcn_port": "GigabitEthernet0/10", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/10", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.150", "interface": "GigabitEthernet0/5", "errdisable_cause": "bpduguard", "vlan": 20, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/5", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.56", "interface": "GigabitEthernet0/12", "errdisable_cause": "bpduguard", "vlan": 30, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/12", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.249", "event_vlan": 40, "mac": "F529.F686.E1CA", "interfaces": ["GigabitEthernet0/7", "GigabitEthernet0/13"], "mac_move_count_5min": 300, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/11", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.16", "event_vlan": 30, "mac": "0D48.A508.83D9", "interfaces": ["TenGigabitEthernet1/1/1", "GigabitEthernet0/11"], "mac_move_count_5min": 300, "possible_causes": "loop"}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.16", "interface": "GigabitEthernet0/11", "errdisable_cause": "storm-control", "vlan": 10, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/11", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.95", "interface": "GigabitEthernet0/18", "errdisable_cause": "storm-control", "vlan": 30, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/18", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/7", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.113", "interface": "GigabitEthernet0/7", "errdisable_cause": "udld", "vlan": 40, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/7", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/1", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.40", "interface": "GigabitEthernet0/1", "errdisable_cause": "port-security", "vlan": 30, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/1", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.171", "interface": "GigabitEthernet0/1", "errdisable_cause": "bpduguard", "vlan": 50, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/1", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.32", "event_vlan": 10, "tcn_count_10min": 5, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/9", "last_tcn_port": "GigabitEthernet0/16", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 10 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/14", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.101", "event_vlan": 30, "tcn_count_10min": 5, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/21", "last_tcn_port": "TenGigabitEthernet1/1/3", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/1", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.133", "event_vlan": 99, "tcn_count_10min": 20, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/11", "last_tcn_port": "GigabitEthernet0/11", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 99 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.127", "event_vlan": 10, "mac": "E13C.86D5.3532", "interfaces": ["GigabitEthernet0/6", "GigabitEthernet0/1"], "mac_move_count_5min": 300, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.154", "interface": "TenGigabitEthernet1/1/2", "errdisable_cause": "port-security", "vlan": 10, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.173", "event_vlan": 10, "mac": "32E7.D14E.3D63", "interfaces": ["GigabitEthernet0/21", "GigabitEthernet0/19"], "mac_move_count_5min": 20, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.46", "event_vlan": 50, "tcn_count_10min": 60, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/12", "last_tcn_port": "GigabitEthernet0/7", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.188", "interface": "GigabitEthernet0/16", "errdisable_cause": "link-flap", "vlan": 10, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/22", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.173", "event_vlan": 40, "mac": "8F46.81A4.5103", "interfaces": ["GigabitEthernet0/22", "GigabitEthernet0/5"], "mac_move_count_5min": 50, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/22", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.210", "event_vlan": 40, "mac": "2BD9.3E3D.9D5E", "interfaces": ["GigabitEthernet0/21", "GigabitEthernet0/24"], "mac_move_count_5min": 300, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.154", "event_vlan": 10, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/4", "last_tcn_port": "GigabitEthernet0/4", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 10 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.104", "interface": "GigabitEthernet0/5", "errdisable_cause": "bpduguard", "vlan": 30, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/5", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.67", "event_vlan": 10, "tcn_count_10min": 200, "root_bridge_vlan": 30, "root_port": "TenGigabitEthernet1/1/2", "last_tcn_port": "TenGigabitEthernet1/1/2", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 10 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "TenGigabitEthernet1/1/4", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.197", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/17", "last_tcn_port": "GigabitEthernet0/17", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/17", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.79", "interface": "GigabitEthernet0/17", "errdisable_cause": "udld", "vlan": 20, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/17", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/12", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.228", "interface": "GigabitEthernet0/12", "errdisable_cause": "port-security", "vlan": 50, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/12", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.114", "event_vlan": 40, "mac": "1A7A.18CD.8510", "interfaces": ["TenGigabitEthernet1/1/1", "GigabitEthernet0/19"], "mac_move_count_5min": 20, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/19", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/7", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.84", "interface": "GigabitEthernet0/7", "errdisable_cause": "bpduguard", "vlan": 40, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/7", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.233", "event_vlan": 20, "mac": "CA79.9095.30AD", "interfaces": ["GigabitEthernet0/19", "GigabitEthernet0/16"], "mac_move_count_5min": 300, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/19", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/2", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.191", "event_vlan": 99, "tcn_count_10min": 60, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/21", "last_tcn_port": "GigabitEthernet0/2", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 99 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.57", "event_vlan": 20, "mac": "B465.5699.BCE4", "interfaces": ["GigabitEthernet0/10", "GigabitEthernet0/11"], "mac_move_count_5min": 20, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.34", "interface": "GigabitEthernet0/12", "errdisable_cause": "udld", "vlan": 40, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/12", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/16", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.146", "interface": "GigabitEthernet0/16", "errdisable_cause": "udld", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/16", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.129", "event_vlan": 99, "mac": "66D0.C4F2.1278", "interfaces": ["GigabitEthernet0/2", "GigabitEthernet0/9"], "mac_move_count_5min": 50, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/2", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/2", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.228", "event_vlan": 50, "tcn_count_10min": 200, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/14", "last_tcn_port": "GigabitEthernet0/14", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/14", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.61", "event_vlan": 10, "mac": "BA01.8DF9.4A8E", "interfaces": ["GigabitEthernet0/16", "GigabitEthernet0/4"], "mac_move_count_5min": 120, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/4", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.156", "event_vlan": 10, "mac": "9C9A.B818.70A7", "interfaces": ["TenGigabitEthernet1/1/1", "TenGigabitEthernet1/1/4"], "mac_move_count_5min": 300, "possible_causes": "loop"}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/20", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.57", "event_vlan": 50, "tcn_count_10min": 5, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/12", "last_tcn_port": "GigabitEthernet0/23", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/23", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/18", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.233", "event_vlan": 30, "mac": "E445.770B.1486", "interfaces": ["GigabitEthernet0/22", "GigabitEthernet0/18"], "mac_move_count_5min": 300, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.80", "interface": "GigabitEthernet0/17", "errdisable_cause": "link-flap", "vlan": 40, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/3", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.206", "interface": "TenGigabitEthernet1/1/3", "errdisable_cause": "link-flap", "vlan": 50, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.209", "event_vlan": 40, "mac": "5213.2DE1.337E", "interfaces": ["GigabitEthernet0/20", "GigabitEthernet0/3"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/14", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.18", "event_vlan": 30, "mac": "F7F7.0EAB.5F2E", "interfaces": ["GigabitEthernet0/20", "GigabitEthernet0/14"], "mac_move_count_5min": 20, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/20", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/3", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.210", "interface": "TenGigabitEthernet1/1/3", "errdisable_cause": "udld", "vlan": 20, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.66", "interface": "GigabitEthernet0/8", "errdisable_cause": "link-flap", "vlan": 99, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/8", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.237", "event_vlan": 50, "mac": "402B.3C5A.A565", "interfaces": ["GigabitEthernet0/20", "GigabitEthernet0/8"], "mac_move_count_5min": 20, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/20", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/23", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.230", "event_vlan": 30, "tcn_count_10min": 5, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/7", "last_tcn_port": "GigabitEthernet0/12", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/12", "spanning-tree guard root"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.16", "event_vlan": 20, "mac": "38EB.96C0.7B96", "interfaces": ["GigabitEthernet0/11", "GigabitEthernet0/1"], "mac_move_count_5min": 20, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/1", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.131", "interface": "GigabitEthernet0/5", "errdisable_cause": "link-flap", "vlan": 40, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.120", "event_vlan": 20, "mac": "7036.D6F5.CC6D", "interfaces": ["GigabitEthernet0/16", "GigabitEthernet0/1"], "mac_move_count_5min": 120, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/1", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/16", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.53", "event_vlan": 10, "tcn_count_10min": 5, "root_bridge_vlan": 10, "root_port": "GigabitEthernet0/23", "last_tcn_port": "GigabitEthernet0/23", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/23", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.147", "interface": "TenGigabitEthernet1/1/2", "errdisable_cause": "storm-control", "vlan": 30, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "TenGigabitEthernet1/1/1", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.107", "event_vlan": 20, "tcn_count_10min": 200, "root_bridge_vlan": 20, "root_port": "TenGigabitEthernet1/1/2", "last_tcn_port": "GigabitEthernet0/2", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 20 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.32", "interface": "GigabitEthernet0/17", "errdisable_cause": "storm-control", "vlan": 10, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/17", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.103", "event_vlan": 50, "mac": "76D6.B988.56F4", "interfaces": ["GigabitEthernet0/12", "GigabitEthernet0/18"], "mac_move_count_5min": 20, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/12", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.37", "interface": "GigabitEthernet0/4", "errdisable_cause": "port-security", "vlan": 30, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/4", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.116", "interface": "GigabitEthernet0/23", "errdisable_cause": "bpduguard", "vlan": 30, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/23", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.38", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/21", "last_tcn_port": "GigabitEthernet0/21", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/21", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.223", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/1", "last_tcn_port": "GigabitEthernet0/1", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/1", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/10", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.140", "event_vlan": 40, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/20", "last_tcn_port": "GigabitEthernet0/5", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.97", "event_vlan": 20, "mac": "63C3.01C9.4DD0", "interfaces": ["GigabitEthernet0/15", "GigabitEthernet0/17"], "mac_move_count_5min": 20, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/17", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.68", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/6", "last_tcn_port": "GigabitEthernet0/1", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.17", "interface": "GigabitEthernet0/19", "errdisable_cause": "storm-control", "vlan": 50, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.151", "interface": "GigabitEthernet0/13", "errdisable_cause": "udld", "vlan": 20, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/13", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.241", "event_vlan": 20, "mac": "85EB.F5B3.C4C7", "interfaces": ["GigabitEthernet0/20", "GigabitEthernet0/8"], "mac_move_count_5min": 20, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/20", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/2", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.53", "interface": "GigabitEthernet0/2", "errdisable_cause": "storm-control", "vlan": 40, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/2", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/3", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.123", "event_vlan": 10, "mac": "C4D5.558B.EBC7", "interfaces": ["GigabitEthernet0/3", "GigabitEthernet0/18"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/3", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.53", "interface": "GigabitEthernet0/3", "errdisable_cause": "link-flap", "vlan": 20, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/3", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.112", "interface": "TenGigabitEthernet1/1/3", "errdisable_cause": "link-flap", "vlan": 20, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.235", "event_vlan": 40, "mac": "C71D.D726.9C69", "interfaces": ["GigabitEthernet0/11", "TenGigabitEthernet1/1/2"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/14", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.159", "interface": "GigabitEthernet0/14", "errdisable_cause": "udld", "vlan": 10, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/14", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.157", "interface": "GigabitEthernet0/23", "errdisable_cause": "bpduguard", "vlan": 10, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/23", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/11", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.113", "interface": "GigabitEthernet0/11", "errdisable_cause": "link-flap", "vlan": 10, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.201", "interface": "GigabitEthernet0/20", "errdisable_cause": "port-security", "vlan": 99, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/20", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.227", "event_vlan": 50, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/4", "last_tcn_port": "GigabitEthernet0/14", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/14", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/4", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.120", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 50, "root_port": "TenGigabitEthernet1/1/1", "last_tcn_port": "GigabitEthernet0/11", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/11", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.230", "interface": "GigabitEthernet0/1", "errdisable_cause": "udld", "vlan": 10, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/1", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.130", "event_vlan": 50, "tcn_count_10min": 20, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 50 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/10", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.232", "interface": "GigabitEthernet0/10", "errdisable_cause": "storm-control", "vlan": 10, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/10", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "TenGigabitEthernet1/1/4", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.165", "interface": "TenGigabitEthernet1/1/4", "errdisable_cause": "udld", "vlan": 40, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/7", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.33", "interface": "GigabitEthernet0/7", "errdisable_cause": "udld", "vlan": 40, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/7", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/18", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.42", "interface": "GigabitEthernet0/18", "errdisable_cause": "link-flap", "vlan": 10, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.71", "event_vlan": 50, "tcn_count_10min": 5, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/17", "last_tcn_port": "GigabitEthernet0/17", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/17", "spanning-tree guard root"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.194", "event_vlan": 40, "mac": "FBF1.8761.3455", "interfaces": ["GigabitEthernet0/19", "GigabitEthernet0/17"], "mac_move_count_5min": 120, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/17", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.196", "event_vlan": 10, "mac": "839E.DC44.3EF0", "interfaces": ["GigabitEthernet0/10", "GigabitEthernet0/11"], "mac_move_count_5min": 120, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/10", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/8", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.107", "event_vlan": 20, "mac": "DDCC.69DB.4B4B", "interfaces": ["GigabitEthernet0/4", "GigabitEthernet0/8"], "mac_move_count_5min": 120, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.180", "interface": "GigabitEthernet0/5", "errdisable_cause": "udld", "vlan": 10, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/5", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/14", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.240", "event_vlan": 50, "tcn_count_10min": 60, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/14", "last_tcn_port": "GigabitEthernet0/14", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/14", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.12", "event_vlan": 50, "mac": "7165.DB6D.9E18", "interfaces": ["GigabitEthernet0/5", "GigabitEthernet0/19"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/19", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.213", "event_vlan": 99, "mac": "0B26.397E.0027", "interfaces": ["TenGigabitEthernet1/1/1", "GigabitEthernet0/17"], "mac_move_count_5min": 120, "possible_causes": "bridge"}], "cli_fix": ["interface TenGigabitEthernet1/1/1", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.234", "event_vlan": 50, "tcn_count_10min": 200, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/15", "last_tcn_port": "TenGigabitEthernet1/1/4", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.131", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 10, "root_port": "TenGigabitEthernet1/1/3", "last_tcn_port": "GigabitEthernet0/1", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.8", "interface": "GigabitEthernet0/9", "errdisable_cause": "link-flap", "vlan": 40, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.157", "interface": "GigabitEthernet0/7", "errdisable_cause": "storm-control", "vlan": 50, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/7", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/19", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.182", "interface": "GigabitEthernet0/19", "errdisable_cause": "storm-control", "vlan": 50, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.129", "interface": "GigabitEthernet0/24", "errdisable_cause": "bpduguard", "vlan": 50, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/24", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.4", "event_vlan": 30, "tcn_count_10min": 20, "root_bridge_vlan": 30, "root_port": "TenGigabitEthernet1/1/2", "last_tcn_port": "TenGigabitEthernet1/1/2", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 30 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.59", "interface": "GigabitEthernet0/24", "errdisable_cause": "bpduguard", "vlan": 40, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/24", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.193", "event_vlan": 30, "mac": "67E4.D038.322A", "interfaces": ["GigabitEthernet0/19", "GigabitEthernet0/24"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/19", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "TenGigabitEthernet1/1/3", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.128", "event_vlan": 20, "mac": "8F81.7321.3589", "interfaces": ["TenGigabitEthernet1/1/3", "GigabitEthernet0/10"], "mac_move_count_5min": 50, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.225", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "TenGigabitEthernet1/1/3", "last_tcn_port": "GigabitEthernet0/8", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/8", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.247", "interface": "GigabitEthernet0/24", "errdisable_cause": "udld", "vlan": 20, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/24", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 50}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.94", "event_vlan": 50, "tcn_count_10min": 200, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/13", "last_tcn_port": "GigabitEthernet0/4", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/4", "spanning-tree guard root"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.201", "event_vlan": 10, "mac": "85C0.0323.24DA", "interfaces": ["TenGigabitEthernet1/1/2", "GigabitEthernet0/21"], "mac_move_count_5min": 50, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.102", "event_vlan": 99, "tcn_count_10min": 20, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/14", "last_tcn_port": "GigabitEthernet0/14", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/14", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/16", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.213", "event_vlan": 50, "tcn_count_10min": 5, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/4", "last_tcn_port": "GigabitEthernet0/4", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/4", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.48", "interface": "GigabitEthernet0/13", "errdisable_cause": "port-security", "vlan": 99, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/13", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.161", "event_vlan": 10, "mac": "6B68.E4F1.B022", "interfaces": ["GigabitEthernet0/5", "GigabitEthernet0/6"], "mac_move_count_5min": 20, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/5", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.60", "event_vlan": 50, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/23", "last_tcn_port": "GigabitEthernet0/9", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.20", "interface": "GigabitEthernet0/20", "errdisable_cause": "udld", "vlan": 20, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/20", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/4", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.38", "interface": "TenGigabitEthernet1/1/4", "errdisable_cause": "port-security", "vlan": 40, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.146", "event_vlan": 99, "mac": "16AD.AF85.22A8", "interfaces": ["TenGigabitEthernet1/1/4", "GigabitEthernet0/11"], "mac_move_count_5min": 50, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/3", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.227", "event_vlan": 40, "mac": "81F2.188E.8D5A", "interfaces": ["TenGigabitEthernet1/1/3", "GigabitEthernet0/5"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/5", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.250", "event_vlan": 10, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/22", "last_tcn_port": "GigabitEthernet0/17", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/17", "spanning-tree guard root"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.245", "event_vlan": 40, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/11", "last_tcn_port": "GigabitEthernet0/11", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.21", "event_vlan": 99, "tcn_count_10min": 20, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/12", "last_tcn_port": "GigabitEthernet0/12", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/12", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.5", "event_vlan": 10, "mac": "415B.58B7.B942", "interfaces": ["GigabitEthernet0/22", "GigabitEthernet0/9"], "mac_move_count_5min": 50, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.8", "event_vlan": 40, "mac": "52CE.8E86.F4F4", "interfaces": ["GigabitEthernet0/4", "GigabitEthernet0/17"], "mac_move_count_5min": 120, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/4", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.176", "interface": "GigabitEthernet0/17", "errdisable_cause": "link-flap", "vlan": 99, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/7", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.246", "event_vlan": 20, "mac": "DE69.F005.CD68", "interfaces": ["GigabitEthernet0/7", "GigabitEthernet0/10"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/7", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.45", "event_vlan": 20, "mac": "39FE.3EA4.C41B", "interfaces": ["GigabitEthernet0/12", "GigabitEthernet0/2"], "mac_move_count_5min": 50, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.184", "event_vlan": 30, "mac": "B609.8626.24DC", "interfaces": ["TenGigabitEthernet1/1/2", "GigabitEthernet0/19"], "mac_move_count_5min": 20, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/19", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.187", "event_vlan": 20, "mac": "0DA0.2C2B.F278", "interfaces": ["GigabitEthernet0/13", "GigabitEthernet0/4"], "mac_move_count_5min": 50, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/13", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/13", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.158", "interface": "GigabitEthernet0/13", "errdisable_cause": "port-security", "vlan": 20, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/13", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.119", "event_vlan": 40, "mac": "9052.9382.BFAB", "interfaces": ["GigabitEthernet0/11", "TenGigabitEthernet1/1/4"], "mac_move_count_5min": 50, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/4", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.211", "interface": "TenGigabitEthernet1/1/4", "errdisable_cause": "port-security", "vlan": 40, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/4", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.71", "event_vlan": 10, "mac": "8B27.7D4A.93C7", "interfaces": ["GigabitEthernet0/17", "TenGigabitEthernet1/1/4"], "mac_move_count_5min": 20, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/17", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.147", "interface": "GigabitEthernet0/7", "errdisable_cause": "storm-control", "vlan": 30, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/7", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.8", "event_vlan": 30, "tcn_count_10min": 60, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/10", "last_tcn_port": "GigabitEthernet0/10", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/10", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.65", "event_vlan": 99, "tcn_count_10min": 200, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/11", "last_tcn_port": "GigabitEthernet0/13", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/13", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/11", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.73", "interface": "GigabitEthernet0/11", "errdisable_cause": "storm-control", "vlan": 99, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/11", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.243", "interface": "GigabitEthernet0/14", "errdisable_cause": "udld", "vlan": 30, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/14", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.220", "event_vlan": 40, "mac": "05EC.DF0B.693E", "interfaces": ["GigabitEthernet0/10", "GigabitEthernet0/11"], "mac_move_count_5min": 20, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/3", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.1.70", "event_vlan": 10, "mac": "941D.F62B.0755", "interfaces": ["GigabitEthernet0/24", "TenGigabitEthernet1/1/3"], "mac_move_count_5min": 120, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/24", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.116", "event_vlan": 40, "mac": "3533.C65A.B3F5", "interfaces": ["TenGigabitEthernet1/1/4", "GigabitEthernet0/11"], "mac_move_count_5min": 50, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "TenGigabitEthernet1/1/2", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.143", "interface": "TenGigabitEthernet1/1/2", "errdisable_cause": "storm-control", "vlan": 10, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.68", "event_vlan": 99, "mac": "17AA.9731.E8A3", "interfaces": ["TenGigabitEthernet1/1/1", "GigabitEthernet0/10"], "mac_move_count_5min": 50, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.62", "interface": "GigabitEthernet0/12", "errdisable_cause": "storm-control", "vlan": 40, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/12", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.217", "event_vlan": 99, "tcn_count_10min": 200, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/18", "last_tcn_port": "TenGigabitEthernet1/1/2", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/3", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.113", "event_vlan": 40, "mac": "373E.59B4.DCAC", "interfaces": ["TenGigabitEthernet1/1/3", "GigabitEthernet0/9"], "mac_move_count_5min": 120, "possible_causes": "loop"}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/1", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.72", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/21", "last_tcn_port": "GigabitEthernet0/16", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/16", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.7", "event_vlan": 99, "mac": "57B1.4485.D704", "interfaces": ["GigabitEthernet0/12", "TenGigabitEthernet1/1/3"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/12", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.134", "event_vlan": 30, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "TenGigabitEthernet1/1/2", "last_tcn_port": "GigabitEthernet0/16", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.241", "interface": "GigabitEthernet0/5", "errdisable_cause": "bpduguard", "vlan": 20, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/5", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.159", "event_vlan": 30, "mac": "E9D7.77F6.671C", "interfaces": ["GigabitEthernet0/17", "GigabitEthernet0/24"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/24", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.6", "interface": "GigabitEthernet0/9", "errdisable_cause": "link-flap", "vlan": 20, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/19", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.154", "event_vlan": 30, "tcn_count_10min": 60, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/10", "last_tcn_port": "GigabitEthernet0/10", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.36", "interface": "GigabitEthernet0/8", "errdisable_cause": "udld", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/8", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/3", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.17", "event_vlan": 20, "mac": "DAA8.EF48.5C3F", "interfaces": ["GigabitEthernet0/22", "TenGigabitEthernet1/1/3"], "mac_move_count_5min": 300, "possible_causes": "loop"}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/20", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.106", "event_vlan": 30, "mac": "FB97.FF4D.BAED", "interfaces": ["GigabitEthernet0/20", "GigabitEthernet0/2"], "mac_move_count_5min": 300, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/2", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.214", "interface": "GigabitEthernet0/12", "errdisable_cause": "bpduguard", "vlan": 20, "port_mode": "trunk", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/12", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/2", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.118", "interface": "TenGigabitEthernet1/1/2", "errdisable_cause": "storm-control", "vlan": 10, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.239", "event_vlan": 20, "mac": "3588.0D3D.76CA", "interfaces": ["GigabitEthernet0/16", "GigabitEthernet0/6"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.221", "event_vlan": 30, "mac": "3E71.1DB5.D378", "interfaces": ["GigabitEthernet0/1", "GigabitEthernet0/6"], "mac_move_count_5min": 20, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.55", "event_vlan": 30, "mac": "30EA.3B2A.7C5E", "interfaces": ["GigabitEthernet0/18", "GigabitEthernet0/22"], "mac_move_count_5min": 50, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/18", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/2", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.223", "event_vlan": 20, "mac": "9CA5.2693.E12E", "interfaces": ["TenGigabitEthernet1/1/2", "GigabitEthernet0/13"], "mac_move_count_5min": 300, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.65", "event_vlan": 20, "mac": "6154.3BC9.739C", "interfaces": ["TenGigabitEthernet1/1/3", "GigabitEthernet0/7"], "mac_move_count_5min": 20, "possible_causes": "bridge"}], "cli_fix": ["interface TenGigabitEthernet1/1/3", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "TenGigabitEthernet1/1/1", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.217", "event_vlan": 50, "tcn_count_10min": 5, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/8", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 50 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/11", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.41", "event_vlan": 30, "mac": "F7D0.924A.F71C", "interfaces": ["GigabitEthernet0/8", "GigabitEthernet0/11"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/11", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.155", "event_vlan": 99, "mac": "845E.003E.0E33", "interfaces": ["GigabitEthernet0/3", "TenGigabitEthernet1/1/4"], "mac_move_count_5min": 120, "possible_causes": "bridge"}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.3.235", "event_vlan": 30, "tcn_count_10min": 5, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/11", "last_tcn_port": "TenGigabitEthernet1/1/2", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.154", "interface": "GigabitEthernet0/19", "errdisable_cause": "udld", "vlan": 10, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/19", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.60", "event_vlan": 30, "mac": "E30C.A277.D898", "interfaces": ["GigabitEthernet0/16", "GigabitEthernet0/18"], "mac_move_count_5min": 300, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.172", "interface": "GigabitEthernet0/19", "errdisable_cause": "storm-control", "vlan": 50, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/19", "no storm-control broadcast", "no storm-control multicast", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.223", "interface": "GigabitEthernet0/20", "errdisable_cause": "link-flap", "vlan": 50, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/20", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.162", "event_vlan": 10, "mac": "4C13.AACF.FDB1", "interfaces": ["GigabitEthernet0/19", "GigabitEthernet0/8"], "mac_move_count_5min": 300, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/8", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.95", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/12", "last_tcn_port": "GigabitEthernet0/6", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.149", "event_vlan": 50, "tcn_count_10min": 200, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/17", "last_tcn_port": "GigabitEthernet0/17", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/17", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.1.155", "event_vlan": 40, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/16", "last_tcn_port": "GigabitEthernet0/16", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/16", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 30}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.177", "event_vlan": 30, "tcn_count_10min": 5, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/21", "last_tcn_port": "GigabitEthernet0/8", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/8", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "high", "interface": "TenGigabitEthernet1/1/2", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.45", "event_vlan": 50, "tcn_count_10min": 5, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/6", "last_tcn_port": "GigabitEthernet0/12", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/12", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.123", "interface": "GigabitEthernet0/2", "errdisable_cause": "bpduguard", "vlan": 30, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/2", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/13", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.82", "interface": "GigabitEthernet0/13", "errdisable_cause": "port-security", "vlan": 30, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/13", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/23", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.111", "event_vlan": 50, "tcn_count_10min": 200, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 50 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.5", "interface": "GigabitEthernet0/19", "errdisable_cause": "udld", "vlan": 20, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.181", "event_vlan": 30, "tcn_count_10min": 20, "root_bridge_vlan": 30, "root_port": "GigabitEthernet0/23", "last_tcn_port": "GigabitEthernet0/7", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 30 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.49", "event_vlan": 30, "mac": "16CF.1F18.89A4", "interfaces": ["GigabitEthernet0/2", "GigabitEthernet0/20"], "mac_move_count_5min": 300, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/20", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.250", "interface": "GigabitEthernet0/24", "errdisable_cause": "link-flap", "vlan": 50, "port_mode": "trunk", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/24", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.89", "event_vlan": 99, "tcn_count_10min": 5, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/3", "last_tcn_port": "GigabitEthernet0/6", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/6", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 10}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.131", "interface": "GigabitEthernet0/2", "errdisable_cause": "bpduguard", "vlan": 10, "port_mode": "access", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/2", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 20}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.192", "interface": "GigabitEthernet0/15", "errdisable_cause": "bpduguard", "vlan": 20, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/15", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/1", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.65", "event_vlan": 99, "tcn_count_10min": 20, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/8", "last_tcn_port": "GigabitEthernet0/8", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/8", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.21", "event_vlan": 20, "mac": "6044.B535.587A", "interfaces": ["GigabitEthernet0/17", "GigabitEthernet0/11"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/15", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.81", "event_vlan": 99, "mac": "17D2.103C.3C4B", "interfaces": ["GigabitEthernet0/15", "GigabitEthernet0/4"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.61", "event_vlan": 10, "tcn_count_10min": 5, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/17", "last_tcn_port": "TenGigabitEthernet1/1/4", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.3.7", "interface": "GigabitEthernet0/5", "errdisable_cause": "udld", "vlan": 40, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/5", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/9", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.186", "event_vlan": 99, "tcn_count_10min": 200, "root_bridge_vlan": 99, "root_port": "GigabitEthernet0/23", "last_tcn_port": "GigabitEthernet0/3", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/3", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/21", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.96", "interface": "GigabitEthernet0/21", "errdisable_cause": "link-flap", "vlan": 99, "port_mode": "trunk", "portfast": false, "port_security": false, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown", "no shutdown"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/24", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.1.95", "interface": "GigabitEthernet0/24", "errdisable_cause": "udld", "vlan": 50, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/24", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 99}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.63", "event_vlan": 99, "mac": "C0E8.90B0.BABE", "interfaces": ["GigabitEthernet0/19", "GigabitEthernet0/5"], "mac_move_count_5min": 120, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/5", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/8", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.210", "interface": "GigabitEthernet0/8", "errdisable_cause": "udld", "vlan": 30, "port_mode": "access", "portfast": true, "port_security": false, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/8", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.186", "event_vlan": 20, "tcn_count_10min": 5, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/18", "last_tcn_port": "GigabitEthernet0/4", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/4", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.60", "event_vlan": 20, "tcn_count_10min": 60, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/20", "last_tcn_port": "TenGigabitEthernet1/1/2", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 20 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/11", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.69", "event_vlan": 20, "mac": "36F9.69C5.E20B", "interfaces": ["GigabitEthernet0/3", "GigabitEthernet0/11"], "mac_move_count_5min": 20, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/3", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.124", "event_vlan": 50, "tcn_count_10min": 60, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/1", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 50 root primary"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.110", "event_vlan": 30, "mac": "C049.F00C.6126", "interfaces": ["GigabitEthernet0/18", "GigabitEthernet0/11"], "mac_move_count_5min": 50, "possible_causes": "loop"}], "cli_fix": ["interface GigabitEthernet0/11", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 30}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.206", "event_vlan": 30, "mac": "550E.A8D0.D99F", "interfaces": ["GigabitEthernet0/22", "GigabitEthernet0/18"], "mac_move_count_5min": 300, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/3", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.2.224", "event_vlan": 99, "tcn_count_10min": 200, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/5", "last_tcn_port": "GigabitEthernet0/5", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 99 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/19", "vlan": 99}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.1.239", "interface": "GigabitEthernet0/19", "errdisable_cause": "port-security", "vlan": 99, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "medium", "interface": "TenGigabitEthernet1/1/2", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.230", "event_vlan": 40, "mac": "3161.266D.B17C", "interfaces": ["TenGigabitEthernet1/1/4", "TenGigabitEthernet1/1/2"], "mac_move_count_5min": 120, "possible_causes": "loop"}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/19", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.78", "interface": "GigabitEthernet0/19", "errdisable_cause": "link-flap", "vlan": 20, "port_mode": "trunk", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/12", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.30", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/1", "last_tcn_port": "GigabitEthernet0/4", "portfast_violation": true}], "cli_fix": ["spanning-tree vlan 40 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.149", "interface": "GigabitEthernet0/18", "errdisable_cause": "udld", "vlan": 10, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/18", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/24", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "mst", "mgmt_ip": "10.0.2.251", "event_vlan": 40, "mac": "9460.E5D5.5E0C", "interfaces": ["GigabitEthernet0/24", "GigabitEthernet0/14"], "mac_move_count_5min": 300, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/14", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "TenGigabitEthernet1/1/1", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.2.198", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/15", "last_tcn_port": "GigabitEthernet0/18", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/18", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 40}, "devices": [{"name": "CORE-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.30", "interface": "GigabitEthernet0/12", "errdisable_cause": "port-security", "vlan": 40, "port_mode": "access", "portfast": true, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/12", "no switchport port-security", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.49", "event_vlan": 40, "tcn_count_10min": 60, "root_bridge_vlan": 40, "root_port": "GigabitEthernet0/21", "last_tcn_port": "GigabitEthernet0/21", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.3.241", "event_vlan": 20, "mac": "305C.7FC8.AB21", "interfaces": ["GigabitEthernet0/2", "GigabitEthernet0/14"], "mac_move_count_5min": 300, "possible_causes": "bridge"}], "cli_fix": ["interface GigabitEthernet0/14", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.238", "event_vlan": 30, "mac": "6FB4.5CFD.D7E0", "interfaces": ["GigabitEthernet0/24", "GigabitEthernet0/21"], "mac_move_count_5min": 120, "possible_causes": "stack inconsistency"}], "cli_fix": ["interface GigabitEthernet0/21", "spanning-tree portfast disable", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 50}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.89", "event_vlan": 50, "tcn_count_10min": 60, "root_bridge_vlan": 50, "root_port": "GigabitEthernet0/17", "last_tcn_port": "GigabitEthernet0/17", "portfast_violation": true}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.27", "event_vlan": 99, "tcn_count_10min": 200, "root_bridge_vlan": 10, "root_port": "TenGigabitEthernet1/1/4", "last_tcn_port": "TenGigabitEthernet1/1/4", "portfast_violation": false}], "cli_fix": ["spanning-tree vlan 99 root primary"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.2.221", "interface": "GigabitEthernet0/13", "errdisable_cause": "udld", "vlan": 99, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/13", "udld port aggressive", "shutdown", "no shutdown"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.98", "event_vlan": 40, "mac": "81C9.83A2.A9EE", "interfaces": ["GigabitEthernet0/5", "GigabitEthernet0/2"], "mac_move_count_5min": 50, "possible_causes": "misconfigured port-channel"}], "cli_fix": ["interface GigabitEthernet0/2", "shutdown", "description INVESTIGATE-MAC-FLAP"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_iosxe", "stp_mode": "mst", "mgmt_ip": "10.0.3.93", "event_vlan": 20, "tcn_count_10min": 60, "root_bridge_vlan": 20, "root_port": "GigabitEthernet0/7", "last_tcn_port": "GigabitEthernet0/7", "portfast_violation": false}], "cli_fix": ["interface GigabitEthernet0/7", "spanning-tree guard root"]}
{"incident_type": "port_errdisable", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Switch port entered err-disable state", "device": "CORE-SW1", "severity": "medium", "interface": "GigabitEthernet0/15", "vlan": 20}, "devices": [{"name": "CORE-SW1", "platform": "cisco_ios", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.29", "interface": "GigabitEthernet0/15", "errdisable_cause": "bpduguard", "vlan": 20, "port_mode": "access", "portfast": false, "port_security": true, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/15", "spanning-tree bpduguard disable", "shutdown", "no shutdown"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/4", "vlan": 40}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "pvst", "mgmt_ip": "10.0.3.197", "event_vlan": 40, "tcn_count_10min": 5, "root_bridge_vlan": 40, "root_port": "TenGigabitEthernet1/1/2", "last_tcn_port": "TenGigabitEthernet1/1/2", "portfast_violation": false}], "cli_fix": ["interface TenGigabitEthernet1/1/2", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "stp_topology_change", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "STP topology change detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/3", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "platform": "cisco_ios", "stp_mode": "pvst", "mgmt_ip": "10.0.2.18", "event_vlan": 10, "tcn_count_10min": 5, "root_bridge_vlan": 99, "root_port": "TenGigabitEthernet1/1/3", "last_tcn_port": "TenGigabitEthernet1/1/4", "portfast_violation": true}], "cli_fix": ["interface TenGigabitEthernet1/1/4", "spanning-tree portfast", "spanning-tree bpduguard enable"]}
{"incident_type": "mac_flapping", "instruction": "Analyze Cisco switching incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal-impact actions (avoid unnecessary global changes)", "If you shutdown a port, include 'no shutdown' only when appropriate for recovery", "Do NOT provide explanation"], "wazuh_alert": {"rule": "MAC address flapping detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6", "vlan": 10}, "devices": [{"name": "DIST-SW1", "platform": "cisco_iosxe", "stp_mode": "rapid-pvst", "mgmt_ip": "10.0.1.66", "event_vlan": 10, "mac": "A5DA.08B1.BF0B", "interfaces": ["GigabitEthernet0/5", "GigabitEthernet0/6"], "mac_move_count_5min": 50, "possible_causes": "hypervisor vSwitch"}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown", "description INVESTIGATE-MAC-FLAP"]}