{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:50:35.051567Z", "cpu_5s_percent": 88, "cpu_1m_percent": 85, "cpu_5m_percent": 74, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 85, "cpu_5m_percent": 74, "top_process": "QoS Stats"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T10:25:35.056617Z", "process": "bgp", "pid": 1535, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 1535, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:35:35.054403Z", "memory_used_percent": 87, "memory_free_mb": 60, "memory_total_mb": 5336, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "memory_used_percent": 87, "memory_free_mb": 60, "memory_total_mb": 5336, "top_consumer": "logging"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:47:35.056711Z", "process": "bgp", "pid": 2257, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "process": "bgp", "pid": 2257, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:09:35.057269Z", "process": "ospf", "pid": 458, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "process": "ospf", "pid": 458, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:24:35.058999Z", "process": "qfp", "pid": 3819, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "qfp", "pid": 3819, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:42:35.060586Z", "process": "ospf", "pid": 1312, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 1312, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:42:35.059135Z", "process": "netconf", "pid": 545, "crash_count_24h": 22, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "process": "netconf", "pid": 545, "crash_count_24h": 22, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:32:35.052601Z", "memory_used_percent": 88, "memory_free_mb": 328, "memory_total_mb": 5640, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 328, "memory_total_mb": 5640, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:11:35.049170Z", "cpu_5s_percent": 93, "cpu_1m_percent": 76, "cpu_5m_percent": 68, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 76, "cpu_5m_percent": 68, "top_process": "QoS Stats"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:21:35.051266Z", "cpu_5s_percent": 97, "cpu_1m_percent": 94, "cpu_5m_percent": 78, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 94, "cpu_5m_percent": 78, "top_process": "Crypto IKEv2"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:48:35.050008Z", "cpu_5s_percent": 95, "cpu_1m_percent": 94, "cpu_5m_percent": 87, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 94, "cpu_5m_percent": 87, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:06:35.052751Z", "memory_used_percent": 88, "memory_free_mb": 204, "memory_total_mb": 3222, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 204, "memory_total_mb": 3222, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:36:35.051695Z", "cpu_5s_percent": 98, "cpu_1m_percent": 89, "cpu_5m_percent": 83, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 89, "cpu_5m_percent": 83, "top_process": "Hulc LED Process"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:40:35.048102Z", "cpu_5s_percent": 87, "cpu_1m_percent": 94, "cpu_5m_percent": 85, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 87, "cpu_1m_percent": 94, "cpu_5m_percent": 85, "top_process": "SSH Process"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:15:35.053194Z", "memory_used_percent": 95, "memory_free_mb": 262, "memory_total_mb": 6841, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 262, "memory_total_mb": 6841, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:48:35.054231Z", "memory_used_percent": 81, "memory_free_mb": 286, "memory_total_mb": 1438, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 286, "memory_total_mb": 1438, "top_consumer": "snmp"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:41:35.058975Z", "process": "ospf", "pid": 2108, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "process": "ospf", "pid": 2108, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:22:35.051014Z", "cpu_5s_percent": 95, "cpu_1m_percent": 96, "cpu_5m_percent": 74, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 96, "cpu_5m_percent": 74, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:56:35.054765Z", "memory_used_percent": 84, "memory_free_mb": 366, "memory_total_mb": 6010, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 366, "memory_total_mb": 6010, "top_consumer": "qos"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:53:35.050613Z", "cpu_5s_percent": 87, "cpu_1m_percent": 84, "cpu_5m_percent": 79, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 84, "cpu_5m_percent": 79, "top_process": "Hulc LED Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:28:35.058228Z", "process": "iosd", "pid": 2407, "crash_count_24h": 10, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "process": "iosd", "pid": 2407, "crash_count_24h": 10, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:33:35.049104Z", "cpu_5s_percent": 92, "cpu_1m_percent": 96, "cpu_5m_percent": 68, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 96, "cpu_5m_percent": 68, "top_process": "SSH Process"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:36:35.053478Z", "memory_used_percent": 83, "memory_free_mb": 351, "memory_total_mb": 7004, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 351, "memory_total_mb": 7004, "top_consumer": "qos"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:15:35.051528Z", "cpu_5s_percent": 88, "cpu_1m_percent": 96, "cpu_5m_percent": 89, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 96, "cpu_5m_percent": 89, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:15:35.050514Z", "cpu_5s_percent": 88, "cpu_1m_percent": 75, "cpu_5m_percent": 80, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 75, "cpu_5m_percent": 80, "top_process": "ARP Input"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:26:35.057739Z", "process": "rp", "pid": 1344, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "rp", "pid": 1344, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:38:35.049606Z", "cpu_5s_percent": 93, "cpu_1m_percent": 98, "cpu_5m_percent": 83, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 98, "cpu_5m_percent": 83, "top_process": "Net Background"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:39:35.054805Z", "memory_used_percent": 82, "memory_free_mb": 146, "memory_total_mb": 4642, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "memory_used_percent": 82, "memory_free_mb": 146, "memory_total_mb": 4642, "top_consumer": "http"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:31:35.055062Z", "memory_used_percent": 85, "memory_free_mb": 210, "memory_total_mb": 6221, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 210, "memory_total_mb": 6221, "top_consumer": "bgp"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:50:35.050554Z", "cpu_5s_percent": 97, "cpu_1m_percent": 91, "cpu_5m_percent": 67, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 91, "cpu_5m_percent": 67, "top_process": "QoS Stats"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:09:35.053084Z", "memory_used_percent": 85, "memory_free_mb": 466, "memory_total_mb": 6542, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "memory_used_percent": 85, "memory_free_mb": 466, "memory_total_mb": 6542, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:09:35.051874Z", "cpu_5s_percent": 95, "cpu_1m_percent": 82, "cpu_5m_percent": 74, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 82, "cpu_5m_percent": 74, "top_process": "QoS Stats"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:55:35.059980Z", "process": "crypto", "pid": 375, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "process": "crypto", "pid": 375, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:14:35.055075Z", "memory_used_percent": 85, "memory_free_mb": 345, "memory_total_mb": 7286, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 345, "memory_total_mb": 7286, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:51:35.049564Z", "cpu_5s_percent": 95, "cpu_1m_percent": 86, "cpu_5m_percent": 87, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "cpu_5s_percent": 95, "cpu_1m_percent": 86, "cpu_5m_percent": 87, "top_process": "CEF RP"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:18:35.055682Z", "memory_used_percent": 90, "memory_free_mb": 332, "memory_total_mb": 1464, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 332, "memory_total_mb": 1464, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:50:35.050643Z", "cpu_5s_percent": 89, "cpu_1m_percent": 76, "cpu_5m_percent": 79, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 89, "cpu_1m_percent": 76, "cpu_5m_percent": 79, "top_process": "Hulc LED Process"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:06:35.055370Z", "memory_used_percent": 92, "memory_free_mb": 448, "memory_total_mb": 3961, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "memory_used_percent": 92, "memory_free_mb": 448, "memory_total_mb": 3961, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:37:35.053711Z", "memory_used_percent": 84, "memory_free_mb": 53, "memory_total_mb": 4383, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 53, "memory_total_mb": 4383, "top_consumer": "bgp"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:37:35.051448Z", "cpu_5s_percent": 95, "cpu_1m_percent": 96, "cpu_5m_percent": 80, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "cpu_5s_percent": 95, "cpu_1m_percent": 96, "cpu_5m_percent": 80, "top_process": "Hulc LED Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:33:35.051438Z", "cpu_5s_percent": 98, "cpu_1m_percent": 91, "cpu_5m_percent": 89, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 91, "cpu_5m_percent": 89, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:52:35.056774Z", "process": "crypto", "pid": 3566, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "crypto", "pid": 3566, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:51:35.048845Z", "cpu_5s_percent": 91, "cpu_1m_percent": 92, "cpu_5m_percent": 69, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 92, "cpu_5m_percent": 69, "top_process": "Net Background"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:44:35.058448Z", "process": "ospf", "pid": 4364, "crash_count_24h": 23, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 4364, "crash_count_24h": 23, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:39:35.051157Z", "cpu_5s_percent": 89, "cpu_1m_percent": 88, "cpu_5m_percent": 81, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "cpu_5s_percent": 89, "cpu_1m_percent": 88, "cpu_5m_percent": 81, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:49:35.055837Z", "memory_used_percent": 86, "memory_free_mb": 492, "memory_total_mb": 6638, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 492, "memory_total_mb": 6638, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:56:35.052872Z", "memory_used_percent": 99, "memory_free_mb": 72, "memory_total_mb": 5637, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 72, "memory_total_mb": 5637, "top_consumer": "qos"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:48:35.056761Z", "process": "rp", "pid": 4120, "crash_count_24h": 7, "last_crash_reason": "Memory corruption", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "rp", "pid": 4120, "crash_count_24h": 7, "last_crash_reason": "Memory corruption"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:06:35.054647Z", "memory_used_percent": 81, "memory_free_mb": 184, "memory_total_mb": 4626, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 184, "memory_total_mb": 4626, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:50:35.054597Z", "memory_used_percent": 87, "memory_free_mb": 99, "memory_total_mb": 1430, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 99, "memory_total_mb": 1430, "top_consumer": "qos"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:58:35.058405Z", "process": "snmpd", "pid": 904, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 904, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:07:35.048926Z", "cpu_5s_percent": 97, "cpu_1m_percent": 76, "cpu_5m_percent": 70, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 76, "cpu_5m_percent": 70, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:51:35.050323Z", "cpu_5s_percent": 99, "cpu_1m_percent": 91, "cpu_5m_percent": 72, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 99, "cpu_1m_percent": 91, "cpu_5m_percent": 72, "top_process": "BGP Scanner"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:53:35.050686Z", "cpu_5s_percent": 86, "cpu_1m_percent": 95, "cpu_5m_percent": 85, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 95, "cpu_5m_percent": 85, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:07:35.060123Z", "process": "qfp", "pid": 4852, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "qfp", "pid": 4852, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:49:35.054715Z", "memory_used_percent": 82, "memory_free_mb": 94, "memory_total_mb": 4203, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 94, "memory_total_mb": 4203, "top_consumer": "netconf"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:04:35.049346Z", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 66, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 66, "top_process": "Hulc LED Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:50:35.052259Z", "memory_used_percent": 91, "memory_free_mb": 207, "memory_total_mb": 3166, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "memory_used_percent": 91, "memory_free_mb": 207, "memory_total_mb": 3166, "top_consumer": "cef"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:21:35.049125Z", "cpu_5s_percent": 98, "cpu_1m_percent": 96, "cpu_5m_percent": 92, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 96, "cpu_5m_percent": 92, "top_process": "ARP Input"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:03:35.057119Z", "process": "bgp", "pid": 2805, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 2805, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:51:35.047940Z", "cpu_5s_percent": 92, "cpu_1m_percent": 82, "cpu_5m_percent": 69, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 82, "cpu_5m_percent": 69, "top_process": "Crypto IKEv2"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:05:35.051276Z", "cpu_5s_percent": 91, "cpu_1m_percent": 99, "cpu_5m_percent": 70, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 91, "cpu_1m_percent": 99, "cpu_5m_percent": 70, "top_process": "ARP Input"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:02:35.056978Z", "process": "telemetry", "pid": 2634, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 2634, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:30:35.058260Z", "process": "snmpd", "pid": 1689, "crash_count_24h": 12, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "snmpd", "pid": 1689, "crash_count_24h": 12, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:08:35.050384Z", "cpu_5s_percent": 87, "cpu_1m_percent": 77, "cpu_5m_percent": 91, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "cpu_5s_percent": 87, "cpu_1m_percent": 77, "cpu_5m_percent": 91, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:36:35.049744Z", "cpu_5s_percent": 94, "cpu_1m_percent": 89, "cpu_5m_percent": 68, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 89, "cpu_5m_percent": 68, "top_process": "Crypto IKEv2"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:09:35.056409Z", "process": "qfp", "pid": 4045, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "process": "qfp", "pid": 4045, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:11:35.055192Z", "memory_used_percent": 85, "memory_free_mb": 113, "memory_total_mb": 4027, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "memory_used_percent": 85, "memory_free_mb": 113, "memory_total_mb": 4027, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:39:35.057751Z", "process": "rp", "pid": 4745, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "process": "rp", "pid": 4745, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T10:33:35.050283Z", "cpu_5s_percent": 95, "cpu_1m_percent": 99, "cpu_5m_percent": 69, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 99, "cpu_5m_percent": 69, "top_process": "SNMP ENGINE"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:32:35.058646Z", "process": "ospf", "pid": 2574, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "process": "ospf", "pid": 2574, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:37:35.054425Z", "memory_used_percent": 98, "memory_free_mb": 410, "memory_total_mb": 2184, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 410, "memory_total_mb": 2184, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:08:35.060901Z", "process": "bgp", "pid": 2226, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "process": "bgp", "pid": 2226, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:12:35.049487Z", "cpu_5s_percent": 98, "cpu_1m_percent": 90, "cpu_5m_percent": 68, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "cpu_5s_percent": 98, "cpu_1m_percent": 90, "cpu_5m_percent": 68, "top_process": "IP Input"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:56:35.051400Z", "cpu_5s_percent": 100, "cpu_1m_percent": 75, "cpu_5m_percent": 76, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 100, "cpu_1m_percent": 75, "cpu_5m_percent": 76, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:45:35.051167Z", "cpu_5s_percent": 90, "cpu_1m_percent": 85, "cpu_5m_percent": 94, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 85, "cpu_5m_percent": 94, "top_process": "OSPF-1 Router"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:54:35.057902Z", "process": "crypto", "pid": 1208, "crash_count_24h": 14, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "crypto", "pid": 1208, "crash_count_24h": 14, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:21:35.055570Z", "memory_used_percent": 90, "memory_free_mb": 308, "memory_total_mb": 4175, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "memory_used_percent": 90, "memory_free_mb": 308, "memory_total_mb": 4175, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:07:35.050182Z", "cpu_5s_percent": 99, "cpu_1m_percent": 86, "cpu_5m_percent": 86, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 86, "cpu_5m_percent": 86, "top_process": "BGP Scanner"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:02:35.057650Z", "process": "netconf", "pid": 2982, "crash_count_24h": 13, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "netconf", "pid": 2982, "crash_count_24h": 13, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:26:35.054435Z", "memory_used_percent": 92, "memory_free_mb": 350, "memory_total_mb": 1851, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 350, "memory_total_mb": 1851, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T10:19:35.057392Z", "process": "qfp", "pid": 3352, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "qfp", "pid": 3352, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:12:35.051657Z", "cpu_5s_percent": 91, "cpu_1m_percent": 99, "cpu_5m_percent": 72, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 99, "cpu_5m_percent": 72, "top_process": "Hulc LED Process"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:15:35.056176Z", "process": "netconf", "pid": 2691, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "process": "netconf", "pid": 2691, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:57:35.049233Z", "cpu_5s_percent": 99, "cpu_1m_percent": 89, "cpu_5m_percent": 79, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 99, "cpu_1m_percent": 89, "cpu_5m_percent": 79, "top_process": "ARP Input"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:58:35.055320Z", "memory_used_percent": 90, "memory_free_mb": 268, "memory_total_mb": 7074, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 268, "memory_total_mb": 7074, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:11:35.057197Z", "process": "crypto", "pid": 979, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "process": "crypto", "pid": 979, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:53:35.055521Z", "memory_used_percent": 99, "memory_free_mb": 150, "memory_total_mb": 2560, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 150, "memory_total_mb": 2560, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:14:35.053739Z", "memory_used_percent": 87, "memory_free_mb": 482, "memory_total_mb": 5281, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 482, "memory_total_mb": 5281, "top_consumer": "qos"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:08:35.048809Z", "cpu_5s_percent": 95, "cpu_1m_percent": 75, "cpu_5m_percent": 83, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 75, "cpu_5m_percent": 83, "top_process": "BGP Scanner"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:56:35.050153Z", "cpu_5s_percent": 96, "cpu_1m_percent": 91, "cpu_5m_percent": 81, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 91, "cpu_5m_percent": 81, "top_process": "Hulc LED Process"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:35:35.050119Z", "cpu_5s_percent": 92, "cpu_1m_percent": 94, "cpu_5m_percent": 90, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 92, "cpu_1m_percent": 94, "cpu_5m_percent": 90, "top_process": "Crypto IKEv2"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:37:35.055503Z", "memory_used_percent": 87, "memory_free_mb": 51, "memory_total_mb": 3820, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "memory_used_percent": 87, "memory_free_mb": 51, "memory_total_mb": 3820, "top_consumer": "cef"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:42:35.050364Z", "cpu_5s_percent": 91, "cpu_1m_percent": 88, "cpu_5m_percent": 79, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 88, "cpu_5m_percent": 79, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:14:35.048067Z", "cpu_5s_percent": 92, "cpu_1m_percent": 99, "cpu_5m_percent": 74, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 92, "cpu_1m_percent": 99, "cpu_5m_percent": 74, "top_process": "IP Input"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:30:35.055721Z", "memory_used_percent": 84, "memory_free_mb": 132, "memory_total_mb": 5808, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 132, "memory_total_mb": 5808, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:23:35.053431Z", "memory_used_percent": 80, "memory_free_mb": 406, "memory_total_mb": 3838, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 406, "memory_total_mb": 3838, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:43:35.057467Z", "process": "netconf", "pid": 2950, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "netconf", "pid": 2950, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:00:35.053176Z", "memory_used_percent": 84, "memory_free_mb": 149, "memory_total_mb": 7702, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 149, "memory_total_mb": 7702, "top_consumer": "qos"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:46:35.058930Z", "process": "ospf", "pid": 1263, "crash_count_24h": 25, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "process": "ospf", "pid": 1263, "crash_count_24h": 25, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:48:35.055339Z", "memory_used_percent": 85, "memory_free_mb": 108, "memory_total_mb": 4307, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 108, "memory_total_mb": 4307, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:27:35.052364Z", "memory_used_percent": 84, "memory_free_mb": 418, "memory_total_mb": 5501, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 418, "memory_total_mb": 5501, "top_consumer": "logging"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:14:35.055580Z", "memory_used_percent": 89, "memory_free_mb": 281, "memory_total_mb": 7616, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 281, "memory_total_mb": 7616, "top_consumer": "snmp"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:32:35.057727Z", "process": "netconf", "pid": 1292, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "netconf", "pid": 1292, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:31:35.060910Z", "process": "snmpd", "pid": 533, "crash_count_24h": 10, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 533, "crash_count_24h": 10, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:44:35.052881Z", "memory_used_percent": 83, "memory_free_mb": 182, "memory_total_mb": 2842, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 182, "memory_total_mb": 2842, "top_consumer": "netconf"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:07:35.049020Z", "cpu_5s_percent": 96, "cpu_1m_percent": 84, "cpu_5m_percent": 70, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 84, "cpu_5m_percent": 70, "top_process": "SNMP ENGINE"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:53:35.050252Z", "cpu_5s_percent": 96, "cpu_1m_percent": 76, "cpu_5m_percent": 77, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 96, "cpu_1m_percent": 76, "cpu_5m_percent": 77, "top_process": "SSH Process"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:07:35.049885Z", "cpu_5s_percent": 99, "cpu_1m_percent": 99, "cpu_5m_percent": 66, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 99, "cpu_1m_percent": 99, "cpu_5m_percent": 66, "top_process": "Net Background"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:29:35.060680Z", "process": "qfp", "pid": 1462, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "qfp", "pid": 1462, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:04:35.052326Z", "memory_used_percent": 87, "memory_free_mb": 244, "memory_total_mb": 5691, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 244, "memory_total_mb": 5691, "top_consumer": "http"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:18:35.056527Z", "process": "qfp", "pid": 3223, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "qfp", "pid": 3223, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:50:35.054683Z", "memory_used_percent": 81, "memory_free_mb": 307, "memory_total_mb": 5703, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "memory_used_percent": 81, "memory_free_mb": 307, "memory_total_mb": 5703, "top_consumer": "netconf"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:59:35.060921Z", "process": "crypto", "pid": 729, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 729, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:14:35.056792Z", "process": "netconf", "pid": 3062, "crash_count_24h": 21, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "netconf", "pid": 3062, "crash_count_24h": 21, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:17:35.053279Z", "memory_used_percent": 96, "memory_free_mb": 397, "memory_total_mb": 7701, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 397, "memory_total_mb": 7701, "top_consumer": "ospf"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:08:35.059353Z", "process": "telemetry", "pid": 1561, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "process": "telemetry", "pid": 1561, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:46:35.052380Z", "memory_used_percent": 81, "memory_free_mb": 479, "memory_total_mb": 7960, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "memory_used_percent": 81, "memory_free_mb": 479, "memory_total_mb": 7960, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:45:35.054513Z", "memory_used_percent": 92, "memory_free_mb": 274, "memory_total_mb": 7025, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 274, "memory_total_mb": 7025, "top_consumer": "qos"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:35:35.048971Z", "cpu_5s_percent": 87, "cpu_1m_percent": 94, "cpu_5m_percent": 67, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "cpu_5s_percent": 87, "cpu_1m_percent": 94, "cpu_5m_percent": 67, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:52:35.055493Z", "memory_used_percent": 99, "memory_free_mb": 357, "memory_total_mb": 4899, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "memory_used_percent": 99, "memory_free_mb": 357, "memory_total_mb": 4899, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:40:35.051781Z", "cpu_5s_percent": 98, "cpu_1m_percent": 92, "cpu_5m_percent": 77, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 92, "cpu_5m_percent": 77, "top_process": "SSH Process"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:35:35.059386Z", "process": "rp", "pid": 3752, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "process": "rp", "pid": 3752, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:51:35.048675Z", "cpu_5s_percent": 94, "cpu_1m_percent": 88, "cpu_5m_percent": 70, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 94, "cpu_1m_percent": 88, "cpu_5m_percent": 70, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:57:35.054755Z", "memory_used_percent": 95, "memory_free_mb": 342, "memory_total_mb": 6012, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 342, "memory_total_mb": 6012, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:37:35.058155Z", "process": "rp", "pid": 3598, "crash_count_24h": 21, "last_crash_reason": "Memory corruption", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "rp", "pid": 3598, "crash_count_24h": 21, "last_crash_reason": "Memory corruption"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:55:35.056852Z", "process": "bgp", "pid": 3363, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "process": "bgp", "pid": 3363, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:32:35.058877Z", "process": "crypto", "pid": 3574, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 3574, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:18:35.055539Z", "memory_used_percent": 94, "memory_free_mb": 387, "memory_total_mb": 5851, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 387, "memory_total_mb": 5851, "top_consumer": "netconf"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:22:35.056165Z", "process": "iosd", "pid": 2703, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "iosd", "pid": 2703, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:18:35.050727Z", "cpu_5s_percent": 90, "cpu_1m_percent": 81, "cpu_5m_percent": 75, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 81, "cpu_5m_percent": 75, "top_process": "Crypto IKEv2"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:43:35.055730Z", "memory_used_percent": 84, "memory_free_mb": 70, "memory_total_mb": 2283, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "memory_used_percent": 84, "memory_free_mb": 70, "memory_total_mb": 2283, "top_consumer": "cef"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:58:35.058119Z", "process": "rp", "pid": 3956, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "rp", "pid": 3956, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:40:35.050202Z", "cpu_5s_percent": 92, "cpu_1m_percent": 95, "cpu_5m_percent": 67, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 92, "cpu_1m_percent": 95, "cpu_5m_percent": 67, "top_process": "QoS Stats"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:19:35.059672Z", "process": "bgp", "pid": 1192, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "bgp", "pid": 1192, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:59:35.055457Z", "memory_used_percent": 80, "memory_free_mb": 102, "memory_total_mb": 4328, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 102, "memory_total_mb": 4328, "top_consumer": "qos"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:06:35.051486Z", "cpu_5s_percent": 97, "cpu_1m_percent": 86, "cpu_5m_percent": 95, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 97, "cpu_1m_percent": 86, "cpu_5m_percent": 95, "top_process": "CEF RP"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:00:35.057659Z", "process": "rp", "pid": 3271, "crash_count_24h": 2, "last_crash_reason": "Memory corruption", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "process": "rp", "pid": 3271, "crash_count_24h": 2, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:19:35.050965Z", "cpu_5s_percent": 95, "cpu_1m_percent": 83, "cpu_5m_percent": 68, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 83, "cpu_5m_percent": 68, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:59:35.055783Z", "memory_used_percent": 80, "memory_free_mb": 108, "memory_total_mb": 6503, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "memory_used_percent": 80, "memory_free_mb": 108, "memory_total_mb": 6503, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:03:35.049075Z", "cpu_5s_percent": 85, "cpu_1m_percent": 78, "cpu_5m_percent": 67, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 85, "cpu_1m_percent": 78, "cpu_5m_percent": 67, "top_process": "CEF RP"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:56:35.052566Z", "memory_used_percent": 93, "memory_free_mb": 380, "memory_total_mb": 7449, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 380, "memory_total_mb": 7449, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:23:35.050737Z", "cpu_5s_percent": 94, "cpu_1m_percent": 78, "cpu_5m_percent": 81, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 78, "cpu_5m_percent": 81, "top_process": "BGP Scanner"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:48:35.057920Z", "process": "iosd", "pid": 3824, "crash_count_24h": 4, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3824, "crash_count_24h": 4, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:53:35.060108Z", "process": "crypto", "pid": 648, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "process": "crypto", "pid": 648, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:28:35.056279Z", "process": "snmpd", "pid": 1567, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 1567, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:21:35.052413Z", "memory_used_percent": 91, "memory_free_mb": 80, "memory_total_mb": 6085, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 80, "memory_total_mb": 6085, "top_consumer": "telemetry"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:53:35.057146Z", "process": "iosd", "pid": 3973, "crash_count_24h": 14, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "process": "iosd", "pid": 3973, "crash_count_24h": 14, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:20:35.049285Z", "cpu_5s_percent": 99, "cpu_1m_percent": 76, "cpu_5m_percent": 82, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 76, "cpu_5m_percent": 82, "top_process": "Hulc LED Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:40:35.051576Z", "cpu_5s_percent": 99, "cpu_1m_percent": 83, "cpu_5m_percent": 71, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 83, "cpu_5m_percent": 71, "top_process": "OSPF-1 Router"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:46:35.048137Z", "cpu_5s_percent": 100, "cpu_1m_percent": 87, "cpu_5m_percent": 93, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 100, "cpu_1m_percent": 87, "cpu_5m_percent": 93, "top_process": "SNMP ENGINE"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:35:35.059468Z", "process": "netconf", "pid": 759, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "process": "netconf", "pid": 759, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:17:35.050464Z", "cpu_5s_percent": 99, "cpu_1m_percent": 85, "cpu_5m_percent": 70, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 85, "cpu_5m_percent": 70, "top_process": "CEF RP"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:54:35.051105Z", "cpu_5s_percent": 94, "cpu_1m_percent": 84, "cpu_5m_percent": 92, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 94, "cpu_1m_percent": 84, "cpu_5m_percent": 92, "top_process": "BGP Scanner"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:24:35.049506Z", "cpu_5s_percent": 93, "cpu_1m_percent": 85, "cpu_5m_percent": 92, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 85, "cpu_5m_percent": 92, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:18:35.057213Z", "process": "iosd", "pid": 274, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 274, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:38:35.048177Z", "cpu_5s_percent": 85, "cpu_1m_percent": 96, "cpu_5m_percent": 88, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 96, "cpu_5m_percent": 88, "top_process": "Crypto IKEv2"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:11:35.054444Z", "memory_used_percent": 93, "memory_free_mb": 455, "memory_total_mb": 6260, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 455, "memory_total_mb": 6260, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:03:35.048819Z", "cpu_5s_percent": 86, "cpu_1m_percent": 82, "cpu_5m_percent": 67, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 82, "cpu_5m_percent": 67, "top_process": "BGP Scanner"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:21:35.053489Z", "memory_used_percent": 87, "memory_free_mb": 191, "memory_total_mb": 6304, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 191, "memory_total_mb": 6304, "top_consumer": "ospf"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:02:35.049295Z", "cpu_5s_percent": 95, "cpu_1m_percent": 99, "cpu_5m_percent": 93, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 99, "cpu_5m_percent": 93, "top_process": "Net Background"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:40:35.055348Z", "memory_used_percent": 95, "memory_free_mb": 459, "memory_total_mb": 4478, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "memory_used_percent": 95, "memory_free_mb": 459, "memory_total_mb": 4478, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:36:35.049834Z", "cpu_5s_percent": 86, "cpu_1m_percent": 99, "cpu_5m_percent": 89, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "cpu_5s_percent": 86, "cpu_1m_percent": 99, "cpu_5m_percent": 89, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:07:35.056969Z", "process": "bgp", "pid": 315, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "process": "bgp", "pid": 315, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:29:35.055822Z", "memory_used_percent": 83, "memory_free_mb": 135, "memory_total_mb": 7359, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 135, "memory_total_mb": 7359, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:58:35.054496Z", "memory_used_percent": 82, "memory_free_mb": 470, "memory_total_mb": 6831, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 470, "memory_total_mb": 6831, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:05:35.057708Z", "process": "snmpd", "pid": 4727, "crash_count_24h": 7, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4727, "crash_count_24h": 7, "last_crash_reason": "Memory corruption"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:33:35.055923Z", "memory_used_percent": 84, "memory_free_mb": 432, "memory_total_mb": 4227, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 432, "memory_total_mb": 4227, "top_consumer": "netconf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:55:35.052183Z", "memory_used_percent": 86, "memory_free_mb": 76, "memory_total_mb": 3223, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "memory_used_percent": 86, "memory_free_mb": 76, "memory_total_mb": 3223, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:51:35.048020Z", "cpu_5s_percent": 98, "cpu_1m_percent": 82, "cpu_5m_percent": 79, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 82, "cpu_5m_percent": 79, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:42:35.052978Z", "memory_used_percent": 85, "memory_free_mb": 219, "memory_total_mb": 5610, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "memory_used_percent": 85, "memory_free_mb": 219, "memory_total_mb": 5610, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:51:35.055431Z", "memory_used_percent": 95, "memory_free_mb": 214, "memory_total_mb": 2997, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 214, "memory_total_mb": 2997, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:27:35.056950Z", "process": "qfp", "pid": 3491, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "process": "qfp", "pid": 3491, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:13:35.058326Z", "process": "telemetry", "pid": 1635, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "process": "telemetry", "pid": 1635, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:00:35.051096Z", "cpu_5s_percent": 99, "cpu_1m_percent": 80, "cpu_5m_percent": 93, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 80, "cpu_5m_percent": 93, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:30:35.049274Z", "cpu_5s_percent": 89, "cpu_1m_percent": 95, "cpu_5m_percent": 87, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 95, "cpu_5m_percent": 87, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:17:35.057581Z", "process": "crypto", "pid": 2218, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "process": "crypto", "pid": 2218, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:45:35.051322Z", "cpu_5s_percent": 94, "cpu_1m_percent": 92, "cpu_5m_percent": 65, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 94, "cpu_1m_percent": 92, "cpu_5m_percent": 65, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:33:35.058720Z", "process": "ospf", "pid": 4985, "crash_count_24h": 14, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "ospf", "pid": 4985, "crash_count_24h": 14, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:10:35.051116Z", "cpu_5s_percent": 91, "cpu_1m_percent": 79, "cpu_5m_percent": 72, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 91, "cpu_1m_percent": 79, "cpu_5m_percent": 72, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:17:35.053684Z", "memory_used_percent": 92, "memory_free_mb": 85, "memory_total_mb": 4834, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 85, "memory_total_mb": 4834, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:32:35.048085Z", "cpu_5s_percent": 96, "cpu_1m_percent": 80, "cpu_5m_percent": 76, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 80, "cpu_5m_percent": 76, "top_process": "Net Background"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:14:35.048990Z", "cpu_5s_percent": 91, "cpu_1m_percent": 96, "cpu_5m_percent": 87, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 91, "cpu_1m_percent": 96, "cpu_5m_percent": 87, "top_process": "Crypto IKEv2"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:10:35.053730Z", "memory_used_percent": 87, "memory_free_mb": 264, "memory_total_mb": 5054, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "memory_used_percent": 87, "memory_free_mb": 264, "memory_total_mb": 5054, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:15:35.056748Z", "process": "qfp", "pid": 154, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "process": "qfp", "pid": 154, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:17:35.055709Z", "memory_used_percent": 96, "memory_free_mb": 111, "memory_total_mb": 4114, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "memory_used_percent": 96, "memory_free_mb": 111, "memory_total_mb": 4114, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:50:35.050810Z", "cpu_5s_percent": 93, "cpu_1m_percent": 89, "cpu_5m_percent": 93, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 89, "cpu_5m_percent": 93, "top_process": "OSPF-1 Router"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:03:35.055409Z", "memory_used_percent": 91, "memory_free_mb": 389, "memory_total_mb": 6564, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 389, "memory_total_mb": 6564, "top_consumer": "qos"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:06:35.053240Z", "memory_used_percent": 94, "memory_free_mb": 184, "memory_total_mb": 3879, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 184, "memory_total_mb": 3879, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:56:35.049369Z", "cpu_5s_percent": 92, "cpu_1m_percent": 90, "cpu_5m_percent": 72, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 92, "cpu_1m_percent": 90, "cpu_5m_percent": 72, "top_process": "Hulc LED Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:24:35.049190Z", "cpu_5s_percent": 85, "cpu_1m_percent": 91, "cpu_5m_percent": 94, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 91, "cpu_5m_percent": 94, "top_process": "CEF RP"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:00:35.056940Z", "process": "rp", "pid": 2291, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "process": "rp", "pid": 2291, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:17:35.056127Z", "process": "crypto", "pid": 1266, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1266, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:46:35.056739Z", "process": "iosd", "pid": 2145, "crash_count_24h": 21, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "iosd", "pid": 2145, "crash_count_24h": 21, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:25:35.053526Z", "memory_used_percent": 90, "memory_free_mb": 117, "memory_total_mb": 4192, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 117, "memory_total_mb": 4192, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:12:35.049664Z", "cpu_5s_percent": 88, "cpu_1m_percent": 77, "cpu_5m_percent": 77, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 77, "cpu_5m_percent": 77, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:36:35.057300Z", "process": "bgp", "pid": 3056, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 3056, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:49:35.054472Z", "memory_used_percent": 85, "memory_free_mb": 358, "memory_total_mb": 3630, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 358, "memory_total_mb": 3630, "top_consumer": "telemetry"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:26:35.059810Z", "process": "ospf", "pid": 680, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "process": "ospf", "pid": 680, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:14:35.051429Z", "cpu_5s_percent": 91, "cpu_1m_percent": 75, "cpu_5m_percent": 79, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 75, "cpu_5m_percent": 79, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:11:35.050787Z", "cpu_5s_percent": 98, "cpu_1m_percent": 80, "cpu_5m_percent": 91, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 80, "cpu_5m_percent": 91, "top_process": "CEF RP"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:16:35.057515Z", "process": "telemetry", "pid": 1168, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "process": "telemetry", "pid": 1168, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:26:35.049157Z", "cpu_5s_percent": 97, "cpu_1m_percent": 96, "cpu_5m_percent": 91, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 96, "cpu_5m_percent": 91, "top_process": "Hulc LED Process"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T00:57:35.050593Z", "cpu_5s_percent": 99, "cpu_1m_percent": 96, "cpu_5m_percent": 94, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 96, "cpu_5m_percent": 94, "top_process": "QoS Stats"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:46:35.055804Z", "memory_used_percent": 97, "memory_free_mb": 420, "memory_total_mb": 3340, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 420, "memory_total_mb": 3340, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:44:35.058293Z", "process": "netconf", "pid": 4648, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4648, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:56:35.052667Z", "memory_used_percent": 92, "memory_free_mb": 446, "memory_total_mb": 3697, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "memory_used_percent": 92, "memory_free_mb": 446, "memory_total_mb": 3697, "top_consumer": "bgp"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:21:35.057441Z", "process": "telemetry", "pid": 4761, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "process": "telemetry", "pid": 4761, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:23:35.059742Z", "process": "iosd", "pid": 1672, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "process": "iosd", "pid": 1672, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:51:35.050756Z", "cpu_5s_percent": 90, "cpu_1m_percent": 98, "cpu_5m_percent": 79, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "cpu_5s_percent": 90, "cpu_1m_percent": 98, "cpu_5m_percent": 79, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:09:35.053655Z", "memory_used_percent": 92, "memory_free_mb": 126, "memory_total_mb": 2490, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 126, "memory_total_mb": 2490, "top_consumer": "bgp"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:38:35.059639Z", "process": "crypto", "pid": 1225, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "process": "crypto", "pid": 1225, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:10:35.056594Z", "process": "telemetry", "pid": 143, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "telemetry", "pid": 143, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:51:35.048032Z", "cpu_5s_percent": 93, "cpu_1m_percent": 79, "cpu_5m_percent": 71, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "cpu_5s_percent": 93, "cpu_1m_percent": 79, "cpu_5m_percent": 71, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:28:35.054318Z", "memory_used_percent": 97, "memory_free_mb": 456, "memory_total_mb": 1183, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 456, "memory_total_mb": 1183, "top_consumer": "qos"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:26:35.059227Z", "process": "netconf", "pid": 1573, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "process": "netconf", "pid": 1573, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:20:35.060791Z", "process": "netconf", "pid": 199, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 199, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:52:35.051351Z", "cpu_5s_percent": 88, "cpu_1m_percent": 79, "cpu_5m_percent": 68, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 79, "cpu_5m_percent": 68, "top_process": "QoS Stats"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:33:35.059828Z", "process": "ospf", "pid": 2771, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 2771, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:31:35.055379Z", "memory_used_percent": 83, "memory_free_mb": 260, "memory_total_mb": 4634, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 260, "memory_total_mb": 4634, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:02:35.051476Z", "cpu_5s_percent": 95, "cpu_1m_percent": 90, "cpu_5m_percent": 76, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 95, "cpu_1m_percent": 90, "cpu_5m_percent": 76, "top_process": "Net Background"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:36:35.056869Z", "process": "rp", "pid": 2919, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "process": "rp", "pid": 2919, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:06:35.057622Z", "process": "bgp", "pid": 2496, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "bgp", "pid": 2496, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:26:35.052397Z", "memory_used_percent": 87, "memory_free_mb": 84, "memory_total_mb": 6817, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 84, "memory_total_mb": 6817, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:45:35.057337Z", "process": "snmpd", "pid": 4674, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "process": "snmpd", "pid": 4674, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:17:35.048147Z", "cpu_5s_percent": 93, "cpu_1m_percent": 98, "cpu_5m_percent": 83, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 98, "cpu_5m_percent": 83, "top_process": "Hulc LED Process"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:08:35.058834Z", "process": "snmpd", "pid": 1200, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 1200, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:58:35.054842Z", "memory_used_percent": 86, "memory_free_mb": 190, "memory_total_mb": 4041, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 190, "memory_total_mb": 4041, "top_consumer": "logging"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:39:35.050564Z", "cpu_5s_percent": 87, "cpu_1m_percent": 91, "cpu_5m_percent": 85, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 91, "cpu_5m_percent": 85, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:31:35.056813Z", "process": "netconf", "pid": 3090, "crash_count_24h": 14, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "process": "netconf", "pid": 3090, "crash_count_24h": 14, "last_crash_reason": "Memory corruption"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:44:35.049136Z", "cpu_5s_percent": 100, "cpu_1m_percent": 82, "cpu_5m_percent": 71, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 82, "cpu_5m_percent": 71, "top_process": "IP Input"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:13:35.057432Z", "process": "snmpd", "pid": 2270, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 2270, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:47:35.059862Z", "process": "qfp", "pid": 1558, "crash_count_24h": 14, "last_crash_reason": "Memory corruption", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "process": "qfp", "pid": 1558, "crash_count_24h": 14, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:28:35.059485Z", "process": "iosd", "pid": 2548, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 2548, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:35:35.053608Z", "memory_used_percent": 91, "memory_free_mb": 114, "memory_total_mb": 7166, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 114, "memory_total_mb": 7166, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:34:35.059915Z", "process": "snmpd", "pid": 4835, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "process": "snmpd", "pid": 4835, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:04:35.054413Z", "memory_used_percent": 84, "memory_free_mb": 224, "memory_total_mb": 6897, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 224, "memory_total_mb": 6897, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:38:35.050423Z", "cpu_5s_percent": 96, "cpu_1m_percent": 92, "cpu_5m_percent": 76, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 92, "cpu_5m_percent": 76, "top_process": "BGP Scanner"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:27:35.053498Z", "memory_used_percent": 99, "memory_free_mb": 195, "memory_total_mb": 7405, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "memory_used_percent": 99, "memory_free_mb": 195, "memory_total_mb": 7405, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:39:35.054247Z", "memory_used_percent": 80, "memory_free_mb": 245, "memory_total_mb": 6620, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 245, "memory_total_mb": 6620, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:08:35.051235Z", "cpu_5s_percent": 91, "cpu_1m_percent": 85, "cpu_5m_percent": 84, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 85, "cpu_5m_percent": 84, "top_process": "Net Background"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:25:35.048056Z", "cpu_5s_percent": 87, "cpu_1m_percent": 92, "cpu_5m_percent": 74, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 92, "cpu_5m_percent": 74, "top_process": "CEF RP"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:57:35.057414Z", "process": "crypto", "pid": 4774, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "process": "crypto", "pid": 4774, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:37:35.053693Z", "memory_used_percent": 94, "memory_free_mb": 54, "memory_total_mb": 4046, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "memory_used_percent": 94, "memory_free_mb": 54, "memory_total_mb": 4046, "top_consumer": "http"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:18:35.055813Z", "memory_used_percent": 94, "memory_free_mb": 299, "memory_total_mb": 1383, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "memory_used_percent": 94, "memory_free_mb": 299, "memory_total_mb": 1383, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:55:35.050926Z", "cpu_5s_percent": 88, "cpu_1m_percent": 99, "cpu_5m_percent": 83, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 99, "cpu_5m_percent": 83, "top_process": "SNMP ENGINE"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:32:35.059312Z", "process": "netconf", "pid": 2208, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "process": "netconf", "pid": 2208, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:47:35.049652Z", "cpu_5s_percent": 100, "cpu_1m_percent": 90, "cpu_5m_percent": 79, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 90, "cpu_5m_percent": 79, "top_process": "Crypto IKEv2"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:17:35.052761Z", "memory_used_percent": 88, "memory_free_mb": 265, "memory_total_mb": 3479, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 265, "memory_total_mb": 3479, "top_consumer": "logging"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:52:35.055237Z", "memory_used_percent": 84, "memory_free_mb": 264, "memory_total_mb": 7828, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "memory_used_percent": 84, "memory_free_mb": 264, "memory_total_mb": 7828, "top_consumer": "ospf"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:44:35.055102Z", "memory_used_percent": 80, "memory_free_mb": 396, "memory_total_mb": 1057, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 396, "memory_total_mb": 1057, "top_consumer": "http"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:21:35.051606Z", "cpu_5s_percent": 89, "cpu_1m_percent": 90, "cpu_5m_percent": 75, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 89, "cpu_1m_percent": 90, "cpu_5m_percent": 75, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:55:35.049754Z", "cpu_5s_percent": 99, "cpu_1m_percent": 77, "cpu_5m_percent": 84, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 99, "cpu_1m_percent": 77, "cpu_5m_percent": 84, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:41:35.054619Z", "memory_used_percent": 86, "memory_free_mb": 99, "memory_total_mb": 1234, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 99, "memory_total_mb": 1234, "top_consumer": "http"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:13:35.056650Z", "process": "iosd", "pid": 4341, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "process": "iosd", "pid": 4341, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:56:35.050212Z", "cpu_5s_percent": 94, "cpu_1m_percent": 90, "cpu_5m_percent": 68, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 90, "cpu_5m_percent": 68, "top_process": "IP Input"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:08:35.054656Z", "memory_used_percent": 81, "memory_free_mb": 127, "memory_total_mb": 7186, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "memory_used_percent": 81, "memory_free_mb": 127, "memory_total_mb": 7186, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:39:35.049535Z", "cpu_5s_percent": 87, "cpu_1m_percent": 82, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "cpu_5s_percent": 87, "cpu_1m_percent": 82, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:08:35.057944Z", "process": "qfp", "pid": 3073, "crash_count_24h": 4, "last_crash_reason": "Unhandled exception", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "qfp", "pid": 3073, "crash_count_24h": 4, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:52:35.049326Z", "cpu_5s_percent": 94, "cpu_1m_percent": 82, "cpu_5m_percent": 73, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 82, "cpu_5m_percent": 73, "top_process": "BGP Scanner"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:55:35.051256Z", "cpu_5s_percent": 99, "cpu_1m_percent": 78, "cpu_5m_percent": 73, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 78, "cpu_5m_percent": 73, "top_process": "SNMP ENGINE"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:02:35.058212Z", "process": "telemetry", "pid": 3491, "crash_count_24h": 3, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "process": "telemetry", "pid": 3491, "crash_count_24h": 3, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:17:35.059077Z", "process": "ospf", "pid": 1530, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "process": "ospf", "pid": 1530, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:47:35.054075Z", "memory_used_percent": 98, "memory_free_mb": 105, "memory_total_mb": 2297, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 105, "memory_total_mb": 2297, "top_consumer": "ospf"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:27:35.057027Z", "process": "rp", "pid": 3943, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "rp", "pid": 3943, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:34:35.054533Z", "memory_used_percent": 94, "memory_free_mb": 87, "memory_total_mb": 7571, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 87, "memory_total_mb": 7571, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:29:35.050039Z", "cpu_5s_percent": 99, "cpu_1m_percent": 80, "cpu_5m_percent": 87, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "cpu_5s_percent": 99, "cpu_1m_percent": 80, "cpu_5m_percent": 87, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:09:35.059095Z", "process": "iosd", "pid": 4072, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "process": "iosd", "pid": 4072, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:28:35.049200Z", "cpu_5s_percent": 95, "cpu_1m_percent": 94, "cpu_5m_percent": 75, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 94, "cpu_5m_percent": 75, "top_process": "SSH Process"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:12:35.056203Z", "process": "rp", "pid": 4089, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "rp", "pid": 4089, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:37:35.055614Z", "memory_used_percent": 97, "memory_free_mb": 405, "memory_total_mb": 6241, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "memory_used_percent": 97, "memory_free_mb": 405, "memory_total_mb": 6241, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:27:35.056556Z", "process": "ospf", "pid": 1367, "crash_count_24h": 15, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 1367, "crash_count_24h": 15, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:34:35.054283Z", "memory_used_percent": 87, "memory_free_mb": 381, "memory_total_mb": 3441, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "memory_used_percent": 87, "memory_free_mb": 381, "memory_total_mb": 3441, "top_consumer": "logging"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:05:35.055795Z", "memory_used_percent": 87, "memory_free_mb": 70, "memory_total_mb": 6615, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "memory_used_percent": 87, "memory_free_mb": 70, "memory_total_mb": 6615, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:37:35.048003Z", "cpu_5s_percent": 85, "cpu_1m_percent": 77, "cpu_5m_percent": 71, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "cpu_5s_percent": 85, "cpu_1m_percent": 77, "cpu_5m_percent": 71, "top_process": "IP Input"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:53:35.056878Z", "process": "crypto", "pid": 1529, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "process": "crypto", "pid": 1529, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T00:56:35.059279Z", "process": "ospf", "pid": 807, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "process": "ospf", "pid": 807, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:42:35.056904Z", "process": "telemetry", "pid": 684, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "process": "telemetry", "pid": 684, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:56:35.048863Z", "cpu_5s_percent": 98, "cpu_1m_percent": 81, "cpu_5m_percent": 68, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 81, "cpu_5m_percent": 68, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:50:35.053440Z", "memory_used_percent": 87, "memory_free_mb": 246, "memory_total_mb": 1755, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 246, "memory_total_mb": 1755, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:02:35.056436Z", "process": "snmpd", "pid": 989, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 989, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:30:35.050444Z", "cpu_5s_percent": 95, "cpu_1m_percent": 86, "cpu_5m_percent": 65, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 86, "cpu_5m_percent": 65, "top_process": "Crypto IKEv2"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:06:35.054609Z", "memory_used_percent": 81, "memory_free_mb": 234, "memory_total_mb": 1055, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 234, "memory_total_mb": 1055, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:51:35.050945Z", "cpu_5s_percent": 86, "cpu_1m_percent": 84, "cpu_5m_percent": 71, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 84, "cpu_5m_percent": 71, "top_process": "Net Background"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:04:35.050574Z", "cpu_5s_percent": 96, "cpu_1m_percent": 98, "cpu_5m_percent": 95, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 98, "cpu_5m_percent": 95, "top_process": "ARP Input"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:31:35.057071Z", "process": "iosd", "pid": 4332, "crash_count_24h": 21, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4332, "crash_count_24h": 21, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:47:35.058663Z", "process": "crypto", "pid": 1402, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 1402, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:50:35.059952Z", "process": "iosd", "pid": 4947, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4947, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:41:35.052130Z", "memory_used_percent": 89, "memory_free_mb": 489, "memory_total_mb": 6820, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 489, "memory_total_mb": 6820, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:50:35.049147Z", "cpu_5s_percent": 91, "cpu_1m_percent": 87, "cpu_5m_percent": 75, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 87, "cpu_5m_percent": 75, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:32:35.056565Z", "process": "rp", "pid": 3355, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "rp", "pid": 3355, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T00:52:35.058752Z", "process": "qfp", "pid": 1702, "crash_count_24h": 8, "last_crash_reason": "Memory corruption", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "process": "qfp", "pid": 1702, "crash_count_24h": 8, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:39:35.059722Z", "process": "snmpd", "pid": 4195, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "process": "snmpd", "pid": 4195, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:34:35.051225Z", "cpu_5s_percent": 99, "cpu_1m_percent": 77, "cpu_5m_percent": 87, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 99, "cpu_1m_percent": 77, "cpu_5m_percent": 87, "top_process": "Crypto IKEv2"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:35:35.053051Z", "memory_used_percent": 94, "memory_free_mb": 108, "memory_total_mb": 3173, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 108, "memory_total_mb": 3173, "top_consumer": "logging"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:23:35.057476Z", "process": "telemetry", "pid": 543, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "process": "telemetry", "pid": 543, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T00:58:35.056997Z", "process": "crypto", "pid": 3744, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 3744, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:28:35.060872Z", "process": "bgp", "pid": 1361, "crash_count_24h": 10, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "bgp", "pid": 1361, "crash_count_24h": 10, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:19:35.056223Z", "process": "telemetry", "pid": 4933, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "process": "telemetry", "pid": 4933, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:19:35.053221Z", "memory_used_percent": 83, "memory_free_mb": 343, "memory_total_mb": 1959, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "memory_used_percent": 83, "memory_free_mb": 343, "memory_total_mb": 1959, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:55:35.051055Z", "cpu_5s_percent": 86, "cpu_1m_percent": 94, "cpu_5m_percent": 69, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 94, "cpu_5m_percent": 69, "top_process": "QoS Stats"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:32:35.053675Z", "memory_used_percent": 83, "memory_free_mb": 307, "memory_total_mb": 6539, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 307, "memory_total_mb": 6539, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:02:35.054833Z", "memory_used_percent": 86, "memory_free_mb": 478, "memory_total_mb": 1496, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 478, "memory_total_mb": 1496, "top_consumer": "http"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:48:35.054178Z", "memory_used_percent": 84, "memory_free_mb": 112, "memory_total_mb": 1121, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 112, "memory_total_mb": 1121, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:21:35.055548Z", "memory_used_percent": 81, "memory_free_mb": 333, "memory_total_mb": 4569, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "memory_used_percent": 81, "memory_free_mb": 333, "memory_total_mb": 4569, "top_consumer": "telemetry"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:16:35.055691Z", "memory_used_percent": 87, "memory_free_mb": 374, "memory_total_mb": 6796, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 374, "memory_total_mb": 6796, "top_consumer": "cef"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:30:35.059601Z", "process": "bgp", "pid": 2617, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "process": "bgp", "pid": 2617, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:51:35.053231Z", "memory_used_percent": 94, "memory_free_mb": 329, "memory_total_mb": 2814, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 329, "memory_total_mb": 2814, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:27:35.058816Z", "process": "snmpd", "pid": 3990, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "snmpd", "pid": 3990, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:03:35.057886Z", "process": "bgp", "pid": 4335, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "process": "bgp", "pid": 4335, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:56:35.050766Z", "cpu_5s_percent": 99, "cpu_1m_percent": 94, "cpu_5m_percent": 74, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 99, "cpu_1m_percent": 94, "cpu_5m_percent": 74, "top_process": "SNMP ENGINE"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:45:35.060021Z", "process": "ospf", "pid": 230, "crash_count_24h": 17, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "ospf", "pid": 230, "crash_count_24h": 17, "last_crash_reason": "Memory corruption"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:11:35.054542Z", "memory_used_percent": 83, "memory_free_mb": 87, "memory_total_mb": 3824, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 87, "memory_total_mb": 3824, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:37:35.057778Z", "process": "snmpd", "pid": 1441, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 1441, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:39:35.052935Z", "memory_used_percent": 82, "memory_free_mb": 109, "memory_total_mb": 7834, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 109, "memory_total_mb": 7834, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:09:35.054155Z", "memory_used_percent": 92, "memory_free_mb": 312, "memory_total_mb": 1425, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 312, "memory_total_mb": 1425, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:28:35.056843Z", "process": "crypto", "pid": 4474, "crash_count_24h": 25, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "process": "crypto", "pid": 4474, "crash_count_24h": 25, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:07:35.057962Z", "process": "snmpd", "pid": 2845, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 2845, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:13:35.051647Z", "cpu_5s_percent": 99, "cpu_1m_percent": 98, "cpu_5m_percent": 84, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 98, "cpu_5m_percent": 84, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:15:35.050060Z", "cpu_5s_percent": 90, "cpu_1m_percent": 80, "cpu_5m_percent": 70, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 90, "cpu_1m_percent": 80, "cpu_5m_percent": 70, "top_process": "QoS Stats"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:45:35.053617Z", "memory_used_percent": 88, "memory_free_mb": 318, "memory_total_mb": 1547, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 318, "memory_total_mb": 1547, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:42:35.055604Z", "memory_used_percent": 86, "memory_free_mb": 369, "memory_total_mb": 6876, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 369, "memory_total_mb": 6876, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:44:35.059622Z", "process": "iosd", "pid": 616, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 616, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:04:35.058465Z", "process": "iosd", "pid": 1677, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 1677, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:40:35.053344Z", "memory_used_percent": 91, "memory_free_mb": 282, "memory_total_mb": 5022, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "memory_used_percent": 91, "memory_free_mb": 282, "memory_total_mb": 5022, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:04:35.050344Z", "cpu_5s_percent": 87, "cpu_1m_percent": 77, "cpu_5m_percent": 75, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 77, "cpu_5m_percent": 75, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:07:35.050653Z", "cpu_5s_percent": 86, "cpu_1m_percent": 82, "cpu_5m_percent": 87, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "cpu_5s_percent": 86, "cpu_1m_percent": 82, "cpu_5m_percent": 87, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:00:35.054796Z", "memory_used_percent": 94, "memory_free_mb": 446, "memory_total_mb": 7789, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 446, "memory_total_mb": 7789, "top_consumer": "cef"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:28:35.057669Z", "process": "snmpd", "pid": 819, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "process": "snmpd", "pid": 819, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:17:35.049389Z", "cpu_5s_percent": 85, "cpu_1m_percent": 77, "cpu_5m_percent": 85, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 85, "cpu_1m_percent": 77, "cpu_5m_percent": 85, "top_process": "CEF RP"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:44:35.053422Z", "memory_used_percent": 86, "memory_free_mb": 294, "memory_total_mb": 1662, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 294, "memory_total_mb": 1662, "top_consumer": "snmp"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T10:21:35.057561Z", "process": "bgp", "pid": 2091, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "bgp", "pid": 2091, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:11:35.055875Z", "memory_used_percent": 82, "memory_free_mb": 344, "memory_total_mb": 7754, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "memory_used_percent": 82, "memory_free_mb": 344, "memory_total_mb": 7754, "top_consumer": "http"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:19:35.052853Z", "memory_used_percent": 92, "memory_free_mb": 323, "memory_total_mb": 5174, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "memory_used_percent": 92, "memory_free_mb": 323, "memory_total_mb": 5174, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:26:35.056861Z", "process": "ospf", "pid": 3785, "crash_count_24h": 25, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "process": "ospf", "pid": 3785, "crash_count_24h": 25, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:00:35.050394Z", "cpu_5s_percent": 89, "cpu_1m_percent": 92, "cpu_5m_percent": 66, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 92, "cpu_5m_percent": 66, "top_process": "ARP Input"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:29:35.059522Z", "process": "telemetry", "pid": 616, "crash_count_24h": 19, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 616, "crash_count_24h": 19, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:02:35.050696Z", "cpu_5s_percent": 97, "cpu_1m_percent": 84, "cpu_5m_percent": 73, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 84, "cpu_5m_percent": 73, "top_process": "SSH Process"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:36:35.058018Z", "process": "qfp", "pid": 2048, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "process": "qfp", "pid": 2048, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:59:35.051341Z", "cpu_5s_percent": 94, "cpu_1m_percent": 77, "cpu_5m_percent": 77, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 94, "cpu_1m_percent": 77, "cpu_5m_percent": 77, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:57:35.055281Z", "memory_used_percent": 95, "memory_free_mb": 156, "memory_total_mb": 6661, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "memory_used_percent": 95, "memory_free_mb": 156, "memory_total_mb": 6661, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:25:35.052111Z", "memory_used_percent": 84, "memory_free_mb": 203, "memory_total_mb": 4107, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 203, "memory_total_mb": 4107, "top_consumer": "snmp"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:38:35.050069Z", "cpu_5s_percent": 100, "cpu_1m_percent": 93, "cpu_5m_percent": 69, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 100, "cpu_1m_percent": 93, "cpu_5m_percent": 69, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:47:35.050886Z", "cpu_5s_percent": 85, "cpu_1m_percent": 95, "cpu_5m_percent": 81, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 95, "cpu_5m_percent": 81, "top_process": "Hulc LED Process"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:50:35.051065Z", "cpu_5s_percent": 96, "cpu_1m_percent": 87, "cpu_5m_percent": 75, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "cpu_5s_percent": 96, "cpu_1m_percent": 87, "cpu_5m_percent": 75, "top_process": "Hulc LED Process"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T00:55:35.060656Z", "process": "crypto", "pid": 4593, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 4593, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:32:35.054482Z", "memory_used_percent": 84, "memory_free_mb": 219, "memory_total_mb": 7129, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 219, "memory_total_mb": 7129, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T10:18:35.049544Z", "cpu_5s_percent": 100, "cpu_1m_percent": 89, "cpu_5m_percent": 90, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 89, "cpu_5m_percent": 90, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:34:35.056636Z", "process": "bgp", "pid": 1389, "crash_count_24h": 4, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "process": "bgp", "pid": 1389, "crash_count_24h": 4, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:37:35.049379Z", "cpu_5s_percent": 97, "cpu_1m_percent": 98, "cpu_5m_percent": 70, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 98, "cpu_5m_percent": 70, "top_process": "ARP Input"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:13:35.049866Z", "cpu_5s_percent": 86, "cpu_1m_percent": 89, "cpu_5m_percent": 67, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 89, "cpu_5m_percent": 67, "top_process": "CEF RP"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:45:35.057089Z", "process": "qfp", "pid": 1638, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "qfp", "pid": 1638, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:48:35.054337Z", "memory_used_percent": 90, "memory_free_mb": 355, "memory_total_mb": 2818, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 355, "memory_total_mb": 2818, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:51:35.050776Z", "cpu_5s_percent": 91, "cpu_1m_percent": 86, "cpu_5m_percent": 86, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 86, "cpu_5m_percent": 86, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:36:35.051891Z", "cpu_5s_percent": 86, "cpu_1m_percent": 92, "cpu_5m_percent": 95, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 92, "cpu_5m_percent": 95, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:53:35.056095Z", "process": "netconf", "pid": 191, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "process": "netconf", "pid": 191, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:20:35.053289Z", "memory_used_percent": 84, "memory_free_mb": 409, "memory_total_mb": 8118, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 409, "memory_total_mb": 8118, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:46:35.055662Z", "memory_used_percent": 99, "memory_free_mb": 494, "memory_total_mb": 6557, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 494, "memory_total_mb": 6557, "top_consumer": "netconf"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:25:35.053646Z", "memory_used_percent": 81, "memory_free_mb": 489, "memory_total_mb": 8093, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 489, "memory_total_mb": 8093, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:46:35.056266Z", "process": "ospf", "pid": 3350, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "process": "ospf", "pid": 3350, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:57:35.057242Z", "process": "rp", "pid": 4536, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "rp", "pid": 4536, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:30:35.051370Z", "cpu_5s_percent": 89, "cpu_1m_percent": 97, "cpu_5m_percent": 75, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 97, "cpu_5m_percent": 75, "top_process": "IP Input"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:37:35.055310Z", "memory_used_percent": 88, "memory_free_mb": 287, "memory_total_mb": 1434, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 287, "memory_total_mb": 1434, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:30:35.051509Z", "cpu_5s_percent": 93, "cpu_1m_percent": 79, "cpu_5m_percent": 68, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 79, "cpu_5m_percent": 68, "top_process": "Hulc LED Process"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:04:35.060781Z", "process": "crypto", "pid": 559, "crash_count_24h": 23, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "process": "crypto", "pid": 559, "crash_count_24h": 23, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:42:35.052742Z", "memory_used_percent": 97, "memory_free_mb": 174, "memory_total_mb": 5709, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 174, "memory_total_mb": 5709, "top_consumer": "netconf"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:16:35.055084Z", "memory_used_percent": 93, "memory_free_mb": 374, "memory_total_mb": 4541, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "memory_used_percent": 93, "memory_free_mb": 374, "memory_total_mb": 4541, "top_consumer": "qos"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:48:35.049253Z", "cpu_5s_percent": 91, "cpu_1m_percent": 79, "cpu_5m_percent": 65, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 91, "cpu_1m_percent": 79, "cpu_5m_percent": 65, "top_process": "SNMP ENGINE"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:48:35.056720Z", "process": "snmpd", "pid": 4003, "crash_count_24h": 12, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "process": "snmpd", "pid": 4003, "crash_count_24h": 12, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:47:35.051765Z", "cpu_5s_percent": 97, "cpu_1m_percent": 91, "cpu_5m_percent": 69, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 91, "cpu_5m_percent": 69, "top_process": "Hulc LED Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:40:35.058497Z", "process": "netconf", "pid": 2320, "crash_count_24h": 6, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "process": "netconf", "pid": 2320, "crash_count_24h": 6, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:37:35.053637Z", "memory_used_percent": 88, "memory_free_mb": 445, "memory_total_mb": 1866, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 445, "memory_total_mb": 1866, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:42:35.057260Z", "process": "snmpd", "pid": 2419, "crash_count_24h": 12, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "process": "snmpd", "pid": 2419, "crash_count_24h": 12, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:03:35.053118Z", "memory_used_percent": 93, "memory_free_mb": 355, "memory_total_mb": 2153, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 355, "memory_total_mb": 2153, "top_consumer": "telemetry"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T10:23:35.057128Z", "process": "qfp", "pid": 1587, "crash_count_24h": 8, "last_crash_reason": "Memory corruption", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "process": "qfp", "pid": 1587, "crash_count_24h": 8, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:23:35.059933Z", "process": "qfp", "pid": 3890, "crash_count_24h": 10, "last_crash_reason": "Segmentation fault", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "qfp", "pid": 3890, "crash_count_24h": 10, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:27:35.052706Z", "memory_used_percent": 82, "memory_free_mb": 52, "memory_total_mb": 3549, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 52, "memory_total_mb": 3549, "top_consumer": "logging"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:33:35.054628Z", "memory_used_percent": 83, "memory_free_mb": 207, "memory_total_mb": 7453, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 207, "memory_total_mb": 7453, "top_consumer": "qos"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:00:35.054273Z", "memory_used_percent": 88, "memory_free_mb": 193, "memory_total_mb": 4677, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 193, "memory_total_mb": 4677, "top_consumer": "snmp"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:47:35.050867Z", "cpu_5s_percent": 98, "cpu_1m_percent": 95, "cpu_5m_percent": 90, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 95, "cpu_5m_percent": 90, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:19:35.053748Z", "memory_used_percent": 83, "memory_free_mb": 308, "memory_total_mb": 2117, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "memory_used_percent": 83, "memory_free_mb": 308, "memory_total_mb": 2117, "top_consumer": "qos"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:09:35.050293Z", "cpu_5s_percent": 90, "cpu_1m_percent": 78, "cpu_5m_percent": 86, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 78, "cpu_5m_percent": 86, "top_process": "Crypto IKEv2"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:40:35.058605Z", "process": "qfp", "pid": 4093, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "qfp", "pid": 4093, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:04:35.054705Z", "memory_used_percent": 82, "memory_free_mb": 399, "memory_total_mb": 4590, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 399, "memory_total_mb": 4590, "top_consumer": "http"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:56:35.049042Z", "cpu_5s_percent": 88, "cpu_1m_percent": 98, "cpu_5m_percent": 82, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 98, "cpu_5m_percent": 82, "top_process": "BGP Scanner"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:02:35.055649Z", "memory_used_percent": 89, "memory_free_mb": 154, "memory_total_mb": 7197, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 154, "memory_total_mb": 7197, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:49:35.058571Z", "process": "snmpd", "pid": 861, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "process": "snmpd", "pid": 861, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:35:35.058894Z", "process": "bgp", "pid": 4834, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 4834, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:48:35.059881Z", "process": "iosd", "pid": 2851, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 2851, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:23:35.048789Z", "cpu_5s_percent": 98, "cpu_1m_percent": 81, "cpu_5m_percent": 94, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 81, "cpu_5m_percent": 94, "top_process": "QoS Stats"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:22:35.052639Z", "memory_used_percent": 87, "memory_free_mb": 340, "memory_total_mb": 7861, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "memory_used_percent": 87, "memory_free_mb": 340, "memory_total_mb": 7861, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:18:35.049554Z", "cpu_5s_percent": 94, "cpu_1m_percent": 96, "cpu_5m_percent": 83, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 96, "cpu_5m_percent": 83, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:33:35.051637Z", "cpu_5s_percent": 94, "cpu_1m_percent": 97, "cpu_5m_percent": 68, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 97, "cpu_5m_percent": 68, "top_process": "SSH Process"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:05:35.052715Z", "memory_used_percent": 82, "memory_free_mb": 145, "memory_total_mb": 4554, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 145, "memory_total_mb": 4554, "top_consumer": "logging"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:10:35.059501Z", "process": "qfp", "pid": 1652, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "process": "qfp", "pid": 1652, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:21:35.050089Z", "cpu_5s_percent": 94, "cpu_1m_percent": 95, "cpu_5m_percent": 95, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 95, "cpu_5m_percent": 95, "top_process": "ARP Input"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:11:35.053581Z", "memory_used_percent": 87, "memory_free_mb": 79, "memory_total_mb": 3026, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "memory_used_percent": 87, "memory_free_mb": 79, "memory_total_mb": 3026, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:59:35.056627Z", "process": "iosd", "pid": 375, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 375, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:29:35.058554Z", "process": "qfp", "pid": 3013, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "process": "qfp", "pid": 3013, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:27:35.049466Z", "cpu_5s_percent": 92, "cpu_1m_percent": 78, "cpu_5m_percent": 87, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 78, "cpu_5m_percent": 87, "top_process": "SSH Process"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:05:35.049724Z", "cpu_5s_percent": 87, "cpu_1m_percent": 96, "cpu_5m_percent": 72, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 87, "cpu_1m_percent": 96, "cpu_5m_percent": 72, "top_process": "Net Background"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:04:35.056302Z", "process": "telemetry", "pid": 3947, "crash_count_24h": 16, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 3947, "crash_count_24h": 16, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:47:35.052657Z", "memory_used_percent": 93, "memory_free_mb": 168, "memory_total_mb": 7894, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 168, "memory_total_mb": 7894, "top_consumer": "ospf"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:16:35.050955Z", "cpu_5s_percent": 97, "cpu_1m_percent": 92, "cpu_5m_percent": 80, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 92, "cpu_5m_percent": 80, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:39:35.060076Z", "process": "crypto", "pid": 4812, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "process": "crypto", "pid": 4812, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:53:35.051686Z", "cpu_5s_percent": 100, "cpu_1m_percent": 77, "cpu_5m_percent": 93, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "cpu_5s_percent": 100, "cpu_1m_percent": 77, "cpu_5m_percent": 93, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:47:35.051312Z", "cpu_5s_percent": 96, "cpu_1m_percent": 76, "cpu_5m_percent": 66, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 76, "cpu_5m_percent": 66, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:41:35.051187Z", "cpu_5s_percent": 90, "cpu_1m_percent": 93, "cpu_5m_percent": 95, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 90, "cpu_1m_percent": 93, "cpu_5m_percent": 95, "top_process": "BGP Scanner"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:25:35.060846Z", "process": "snmpd", "pid": 4653, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4653, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:48:35.053544Z", "memory_used_percent": 88, "memory_free_mb": 160, "memory_total_mb": 1350, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 160, "memory_total_mb": 1350, "top_consumer": "bgp"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:28:35.056729Z", "process": "iosd", "pid": 4187, "crash_count_24h": 25, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "process": "iosd", "pid": 4187, "crash_count_24h": 25, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:45:35.058042Z", "process": "bgp", "pid": 2104, "crash_count_24h": 19, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "process": "bgp", "pid": 2104, "crash_count_24h": 19, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:22:35.056536Z", "process": "ospf", "pid": 2420, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 2420, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:16:35.049415Z", "cpu_5s_percent": 93, "cpu_1m_percent": 77, "cpu_5m_percent": 80, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 77, "cpu_5m_percent": 80, "top_process": "CEF RP"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:00:35.049223Z", "cpu_5s_percent": 85, "cpu_1m_percent": 84, "cpu_5m_percent": 74, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 85, "cpu_1m_percent": 84, "cpu_5m_percent": 74, "top_process": "CEF RP"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:54:35.058588Z", "process": "iosd", "pid": 1933, "crash_count_24h": 6, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 1933, "crash_count_24h": 6, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:40:35.050858Z", "cpu_5s_percent": 98, "cpu_1m_percent": 78, "cpu_5m_percent": 89, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 78, "cpu_5m_percent": 89, "top_process": "OSPF-1 Router"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:50:35.049968Z", "cpu_5s_percent": 91, "cpu_1m_percent": 97, "cpu_5m_percent": 72, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 97, "cpu_5m_percent": 72, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:27:35.052222Z", "memory_used_percent": 86, "memory_free_mb": 429, "memory_total_mb": 1985, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 429, "memory_total_mb": 1985, "top_consumer": "logging"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:05:35.056334Z", "process": "qfp", "pid": 4049, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "qfp", "pid": 4049, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:07:35.055632Z", "memory_used_percent": 96, "memory_free_mb": 104, "memory_total_mb": 1231, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 104, "memory_total_mb": 1231, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:16:35.049477Z", "cpu_5s_percent": 96, "cpu_1m_percent": 92, "cpu_5m_percent": 78, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "cpu_5s_percent": 96, "cpu_1m_percent": 92, "cpu_5m_percent": 78, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:12:35.055260Z", "memory_used_percent": 83, "memory_free_mb": 451, "memory_total_mb": 1894, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 451, "memory_total_mb": 1894, "top_consumer": "logging"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T10:27:35.057098Z", "process": "ospf", "pid": 2411, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "ospf", "pid": 2411, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:49:35.054462Z", "memory_used_percent": 89, "memory_free_mb": 115, "memory_total_mb": 2479, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "memory_used_percent": 89, "memory_free_mb": 115, "memory_total_mb": 2479, "top_consumer": "bgp"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:55:35.050129Z", "cpu_5s_percent": 89, "cpu_1m_percent": 95, "cpu_5m_percent": 68, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 89, "cpu_1m_percent": 95, "cpu_5m_percent": 68, "top_process": "SSH Process"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:56:35.050906Z", "cpu_5s_percent": 87, "cpu_1m_percent": 91, "cpu_5m_percent": 82, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "cpu_5s_percent": 87, "cpu_1m_percent": 91, "cpu_5m_percent": 82, "top_process": "ARP Input"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:50:35.057056Z", "process": "telemetry", "pid": 2147, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 2147, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:10:35.055293Z", "memory_used_percent": 82, "memory_free_mb": 106, "memory_total_mb": 7866, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 106, "memory_total_mb": 7866, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:12:35.057383Z", "process": "iosd", "pid": 4713, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "process": "iosd", "pid": 4713, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:10:35.053702Z", "memory_used_percent": 99, "memory_free_mb": 174, "memory_total_mb": 4824, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "memory_used_percent": 99, "memory_free_mb": 174, "memory_total_mb": 4824, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:22:35.050404Z", "cpu_5s_percent": 96, "cpu_1m_percent": 96, "cpu_5m_percent": 95, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 96, "cpu_1m_percent": 96, "cpu_5m_percent": 95, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T00:43:35.060626Z", "process": "ospf", "pid": 280, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "ospf", "pid": 280, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:22:35.054583Z", "memory_used_percent": 86, "memory_free_mb": 259, "memory_total_mb": 6735, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 259, "memory_total_mb": 6735, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:08:35.056399Z", "process": "telemetry", "pid": 4717, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "process": "telemetry", "pid": 4717, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:43:35.054746Z", "memory_used_percent": 83, "memory_free_mb": 452, "memory_total_mb": 3367, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "memory_used_percent": 83, "memory_free_mb": 452, "memory_total_mb": 3367, "top_consumer": "netconf"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:12:35.056584Z", "process": "snmpd", "pid": 921, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 921, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:26:35.059417Z", "process": "snmpd", "pid": 2801, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 2801, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:36:35.053269Z", "memory_used_percent": 99, "memory_free_mb": 325, "memory_total_mb": 2403, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 325, "memory_total_mb": 2403, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:31:35.055052Z", "memory_used_percent": 98, "memory_free_mb": 284, "memory_total_mb": 2197, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 284, "memory_total_mb": 2197, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:36:35.049999Z", "cpu_5s_percent": 85, "cpu_1m_percent": 98, "cpu_5m_percent": 69, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 98, "cpu_5m_percent": 69, "top_process": "Net Background"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:50:35.049398Z", "cpu_5s_percent": 97, "cpu_1m_percent": 85, "cpu_5m_percent": 71, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 85, "cpu_5m_percent": 71, "top_process": "Crypto IKEv2"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:22:35.056690Z", "process": "netconf", "pid": 3858, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "netconf", "pid": 3858, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:50:35.050633Z", "cpu_5s_percent": 86, "cpu_1m_percent": 89, "cpu_5m_percent": 94, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 86, "cpu_1m_percent": 89, "cpu_5m_percent": 94, "top_process": "Net Background"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:18:35.054696Z", "memory_used_percent": 94, "memory_free_mb": 138, "memory_total_mb": 2393, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 138, "memory_total_mb": 2393, "top_consumer": "http"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:22:35.056372Z", "process": "ospf", "pid": 1986, "crash_count_24h": 15, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "process": "ospf", "pid": 1986, "crash_count_24h": 15, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:50:35.056659Z", "process": "netconf", "pid": 2946, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "process": "netconf", "pid": 2946, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:32:35.052491Z", "memory_used_percent": 89, "memory_free_mb": 58, "memory_total_mb": 5138, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "memory_used_percent": 89, "memory_free_mb": 58, "memory_total_mb": 5138, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:00:35.056784Z", "process": "crypto", "pid": 3868, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 3868, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:21:35.051717Z", "cpu_5s_percent": 96, "cpu_1m_percent": 97, "cpu_5m_percent": 67, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 97, "cpu_5m_percent": 67, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:05:35.057999Z", "process": "bgp", "pid": 2173, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "bgp", "pid": 2173, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:11:35.053404Z", "memory_used_percent": 82, "memory_free_mb": 385, "memory_total_mb": 3976, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 385, "memory_total_mb": 3976, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:04:35.054143Z", "memory_used_percent": 86, "memory_free_mb": 477, "memory_total_mb": 8041, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 477, "memory_total_mb": 8041, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:04:35.059176Z", "process": "crypto", "pid": 3661, "crash_count_24h": 2, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "crypto", "pid": 3661, "crash_count_24h": 2, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:21:35.056804Z", "process": "qfp", "pid": 2910, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "qfp", "pid": 2910, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:57:35.051548Z", "cpu_5s_percent": 92, "cpu_1m_percent": 92, "cpu_5m_percent": 88, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 92, "cpu_5m_percent": 88, "top_process": "QoS Stats"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:29:35.052584Z", "memory_used_percent": 87, "memory_free_mb": 158, "memory_total_mb": 8135, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 158, "memory_total_mb": 8135, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:07:35.055902Z", "memory_used_percent": 83, "memory_free_mb": 198, "memory_total_mb": 7470, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "memory_used_percent": 83, "memory_free_mb": 198, "memory_total_mb": 7470, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:50:35.051207Z", "cpu_5s_percent": 93, "cpu_1m_percent": 95, "cpu_5m_percent": 71, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "cpu_5s_percent": 93, "cpu_1m_percent": 95, "cpu_5m_percent": 71, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:17:35.053250Z", "memory_used_percent": 98, "memory_free_mb": 402, "memory_total_mb": 3896, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 402, "memory_total_mb": 3896, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:55:35.054787Z", "memory_used_percent": 89, "memory_free_mb": 209, "memory_total_mb": 3320, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 209, "memory_total_mb": 3320, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:08:35.052724Z", "memory_used_percent": 83, "memory_free_mb": 63, "memory_total_mb": 1758, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 63, "memory_total_mb": 1758, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:20:35.057678Z", "process": "telemetry", "pid": 2659, "crash_count_24h": 21, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "telemetry", "pid": 2659, "crash_count_24h": 21, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:09:35.051380Z", "cpu_5s_percent": 89, "cpu_1m_percent": 85, "cpu_5m_percent": 94, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 85, "cpu_5m_percent": 94, "top_process": "Hulc LED Process"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:04:35.057494Z", "process": "ospf", "pid": 1919, "crash_count_24h": 15, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "process": "ospf", "pid": 1919, "crash_count_24h": 15, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:26:35.049636Z", "cpu_5s_percent": 86, "cpu_1m_percent": 92, "cpu_5m_percent": 74, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 92, "cpu_5m_percent": 74, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:30:35.055912Z", "memory_used_percent": 92, "memory_free_mb": 470, "memory_total_mb": 6436, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 470, "memory_total_mb": 6436, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:45:35.051467Z", "cpu_5s_percent": 93, "cpu_1m_percent": 92, "cpu_5m_percent": 74, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 92, "cpu_5m_percent": 74, "top_process": "SNMP ENGINE"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:50:35.058244Z", "process": "bgp", "pid": 1032, "crash_count_24h": 23, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 1032, "crash_count_24h": 23, "last_crash_reason": "Memory corruption"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:00:35.059370Z", "process": "ospf", "pid": 3717, "crash_count_24h": 24, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "ospf", "pid": 3717, "crash_count_24h": 24, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:05:35.048114Z", "cpu_5s_percent": 93, "cpu_1m_percent": 95, "cpu_5m_percent": 87, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 95, "cpu_5m_percent": 87, "top_process": "CEF RP"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:51:35.054358Z", "memory_used_percent": 87, "memory_free_mb": 186, "memory_total_mb": 5395, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "memory_used_percent": 87, "memory_free_mb": 186, "memory_total_mb": 5395, "top_consumer": "bgp"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:01:35.059773Z", "process": "snmpd", "pid": 453, "crash_count_24h": 3, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 453, "crash_count_24h": 3, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:34:35.051626Z", "cpu_5s_percent": 92, "cpu_1m_percent": 76, "cpu_5m_percent": 86, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 76, "cpu_5m_percent": 86, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:19:35.053373Z", "memory_used_percent": 97, "memory_free_mb": 345, "memory_total_mb": 2093, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 345, "memory_total_mb": 2093, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:47:35.052770Z", "memory_used_percent": 95, "memory_free_mb": 354, "memory_total_mb": 6075, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 354, "memory_total_mb": 6075, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:56:35.059194Z", "process": "bgp", "pid": 897, "crash_count_24h": 19, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "process": "bgp", "pid": 897, "crash_count_24h": 19, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:05:35.051458Z", "cpu_5s_percent": 95, "cpu_1m_percent": 92, "cpu_5m_percent": 76, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 92, "cpu_5m_percent": 76, "top_process": "Hulc LED Process"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:14:35.056575Z", "process": "qfp", "pid": 2178, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "process": "qfp", "pid": 2178, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:56:35.059153Z", "process": "qfp", "pid": 2568, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "qfp", "pid": 2568, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:28:35.056987Z", "process": "snmpd", "pid": 334, "crash_count_24h": 3, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "process": "snmpd", "pid": 334, "crash_count_24h": 3, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:13:35.050916Z", "cpu_5s_percent": 86, "cpu_1m_percent": 95, "cpu_5m_percent": 77, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 95, "cpu_5m_percent": 77, "top_process": "Net Background"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:17:35.055210Z", "memory_used_percent": 94, "memory_free_mb": 244, "memory_total_mb": 2036, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 244, "memory_total_mb": 2036, "top_consumer": "netconf"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:57:35.055765Z", "memory_used_percent": 92, "memory_free_mb": 97, "memory_total_mb": 3886, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "memory_used_percent": 92, "memory_free_mb": 97, "memory_total_mb": 3886, "top_consumer": "http"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:33:35.051585Z", "cpu_5s_percent": 85, "cpu_1m_percent": 98, "cpu_5m_percent": 75, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 85, "cpu_1m_percent": 98, "cpu_5m_percent": 75, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:37:35.052732Z", "memory_used_percent": 90, "memory_free_mb": 492, "memory_total_mb": 4179, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "memory_used_percent": 90, "memory_free_mb": 492, "memory_total_mb": 4179, "top_consumer": "bgp"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:52:35.051024Z", "cpu_5s_percent": 99, "cpu_1m_percent": 86, "cpu_5m_percent": 79, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 99, "cpu_1m_percent": 86, "cpu_5m_percent": 79, "top_process": "OSPF-1 Router"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:04:35.050303Z", "cpu_5s_percent": 95, "cpu_1m_percent": 75, "cpu_5m_percent": 70, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 75, "cpu_5m_percent": 70, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:33:35.054991Z", "memory_used_percent": 97, "memory_free_mb": 142, "memory_total_mb": 3430, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 142, "memory_total_mb": 3430, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:04:35.051410Z", "cpu_5s_percent": 85, "cpu_1m_percent": 94, "cpu_5m_percent": 80, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 85, "cpu_1m_percent": 94, "cpu_5m_percent": 80, "top_process": "SSH Process"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:28:35.050313Z", "cpu_5s_percent": 88, "cpu_1m_percent": 98, "cpu_5m_percent": 67, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "cpu_5s_percent": 88, "cpu_1m_percent": 98, "cpu_5m_percent": 67, "top_process": "Hulc LED Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:48:35.055530Z", "memory_used_percent": 90, "memory_free_mb": 105, "memory_total_mb": 7226, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 105, "memory_total_mb": 7226, "top_consumer": "qos"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:33:35.060728Z", "process": "qfp", "pid": 2723, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "qfp", "pid": 2723, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:57:35.049010Z", "cpu_5s_percent": 87, "cpu_1m_percent": 92, "cpu_5m_percent": 71, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 87, "cpu_1m_percent": 92, "cpu_5m_percent": 71, "top_process": "BGP Scanner"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:18:35.053535Z", "memory_used_percent": 85, "memory_free_mb": 440, "memory_total_mb": 4882, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "memory_used_percent": 85, "memory_free_mb": 440, "memory_total_mb": 4882, "top_consumer": "ospf"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:44:35.050544Z", "cpu_5s_percent": 85, "cpu_1m_percent": 85, "cpu_5m_percent": 70, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 85, "cpu_5m_percent": 70, "top_process": "CEF RP"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:19:35.057688Z", "process": "snmpd", "pid": 4859, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "process": "snmpd", "pid": 4859, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:06:35.050981Z", "cpu_5s_percent": 95, "cpu_1m_percent": 80, "cpu_5m_percent": 80, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 95, "cpu_1m_percent": 80, "cpu_5m_percent": 80, "top_process": "CEF RP"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:16:35.051246Z", "cpu_5s_percent": 97, "cpu_1m_percent": 79, "cpu_5m_percent": 89, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 97, "cpu_1m_percent": 79, "cpu_5m_percent": 89, "top_process": "ARP Input"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:25:35.056381Z", "process": "snmpd", "pid": 3466, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 3466, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:49:35.057080Z", "process": "ospf", "pid": 1594, "crash_count_24h": 6, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "ospf", "pid": 1594, "crash_count_24h": 6, "last_crash_reason": "Memory corruption"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:03:35.059757Z", "process": "iosd", "pid": 2364, "crash_count_24h": 3, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 2364, "crash_count_24h": 3, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:32:35.048957Z", "cpu_5s_percent": 100, "cpu_1m_percent": 91, "cpu_5m_percent": 94, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 91, "cpu_5m_percent": 94, "top_process": "QoS Stats"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:03:35.057524Z", "process": "crypto", "pid": 4394, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 4394, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:22:35.057041Z", "process": "rp", "pid": 4990, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "rp", "pid": 4990, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:58:35.052146Z", "memory_used_percent": 93, "memory_free_mb": 335, "memory_total_mb": 5365, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 335, "memory_total_mb": 5365, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:16:35.060039Z", "process": "qfp", "pid": 3899, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "qfp", "pid": 3899, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:50:35.051829Z", "cpu_5s_percent": 86, "cpu_1m_percent": 82, "cpu_5m_percent": 88, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 82, "cpu_5m_percent": 88, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:09:35.059845Z", "process": "ospf", "pid": 3958, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "ospf", "pid": 3958, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:39:35.053066Z", "memory_used_percent": 99, "memory_free_mb": 250, "memory_total_mb": 5832, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 250, "memory_total_mb": 5832, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:32:35.049621Z", "cpu_5s_percent": 94, "cpu_1m_percent": 82, "cpu_5m_percent": 76, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 82, "cpu_5m_percent": 76, "top_process": "SNMP ENGINE"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:03:35.060814Z", "process": "telemetry", "pid": 1243, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "process": "telemetry", "pid": 1243, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:28:35.053572Z", "memory_used_percent": 84, "memory_free_mb": 324, "memory_total_mb": 3700, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 324, "memory_total_mb": 3700, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:16:35.052167Z", "memory_used_percent": 90, "memory_free_mb": 381, "memory_total_mb": 1671, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 381, "memory_total_mb": 1671, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:34:35.049115Z", "cpu_5s_percent": 92, "cpu_1m_percent": 80, "cpu_5m_percent": 90, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 92, "cpu_1m_percent": 80, "cpu_5m_percent": 90, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:11:35.051538Z", "cpu_5s_percent": 100, "cpu_1m_percent": 90, "cpu_5m_percent": 85, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 90, "cpu_5m_percent": 85, "top_process": "SSH Process"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:40:35.051798Z", "cpu_5s_percent": 91, "cpu_1m_percent": 98, "cpu_5m_percent": 89, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 98, "cpu_5m_percent": 89, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:12:35.057632Z", "process": "qfp", "pid": 4991, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "qfp", "pid": 4991, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:54:35.049426Z", "cpu_5s_percent": 87, "cpu_1m_percent": 99, "cpu_5m_percent": 95, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 99, "cpu_5m_percent": 95, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:59:35.055183Z", "memory_used_percent": 87, "memory_free_mb": 164, "memory_total_mb": 6980, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 164, "memory_total_mb": 6980, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:25:35.056419Z", "process": "crypto", "pid": 2266, "crash_count_24h": 7, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "process": "crypto", "pid": 2266, "crash_count_24h": 7, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:26:35.054308Z", "memory_used_percent": 82, "memory_free_mb": 193, "memory_total_mb": 4161, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 193, "memory_total_mb": 4161, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:17:35.060545Z", "process": "ospf", "pid": 756, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 756, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:55:35.052201Z", "memory_used_percent": 97, "memory_free_mb": 161, "memory_total_mb": 4951, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "memory_used_percent": 97, "memory_free_mb": 161, "memory_total_mb": 4951, "top_consumer": "http"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:45:35.050474Z", "cpu_5s_percent": 89, "cpu_1m_percent": 80, "cpu_5m_percent": 89, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 89, "cpu_1m_percent": 80, "cpu_5m_percent": 89, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:02:35.052807Z", "memory_used_percent": 95, "memory_free_mb": 344, "memory_total_mb": 7429, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "memory_used_percent": 95, "memory_free_mb": 344, "memory_total_mb": 7429, "top_consumer": "http"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:04:35.055000Z", "memory_used_percent": 97, "memory_free_mb": 440, "memory_total_mb": 2523, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "memory_used_percent": 97, "memory_free_mb": 440, "memory_total_mb": 2523, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:30:35.054939Z", "memory_used_percent": 90, "memory_free_mb": 491, "memory_total_mb": 3292, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "memory_used_percent": 90, "memory_free_mb": 491, "memory_total_mb": 3292, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:06:35.052779Z", "memory_used_percent": 80, "memory_free_mb": 252, "memory_total_mb": 3745, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 252, "memory_total_mb": 3745, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:19:35.059033Z", "process": "bgp", "pid": 2490, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "bgp", "pid": 2490, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:34:35.049713Z", "cpu_5s_percent": 85, "cpu_1m_percent": 88, "cpu_5m_percent": 79, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "cpu_5s_percent": 85, "cpu_1m_percent": 88, "cpu_5m_percent": 79, "top_process": "OSPF-1 Router"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:11:35.054860Z", "memory_used_percent": 97, "memory_free_mb": 229, "memory_total_mb": 3844, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "memory_used_percent": 97, "memory_free_mb": 229, "memory_total_mb": 3844, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:34:35.049694Z", "cpu_5s_percent": 98, "cpu_1m_percent": 84, "cpu_5m_percent": 83, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 84, "cpu_5m_percent": 83, "top_process": "QoS Stats"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:28:35.060891Z", "process": "netconf", "pid": 4860, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "process": "netconf", "pid": 4860, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:05:35.053458Z", "memory_used_percent": 80, "memory_free_mb": 362, "memory_total_mb": 6348, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "memory_used_percent": 80, "memory_free_mb": 362, "memory_total_mb": 6348, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:19:35.055700Z", "memory_used_percent": 86, "memory_free_mb": 200, "memory_total_mb": 4700, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "memory_used_percent": 86, "memory_free_mb": 200, "memory_total_mb": 4700, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:26:35.052550Z", "memory_used_percent": 92, "memory_free_mb": 332, "memory_total_mb": 4923, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 332, "memory_total_mb": 4923, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:46:35.048799Z", "cpu_5s_percent": 96, "cpu_1m_percent": 89, "cpu_5m_percent": 93, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 89, "cpu_5m_percent": 93, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:40:35.058911Z", "process": "bgp", "pid": 410, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 410, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:58:35.055400Z", "memory_used_percent": 96, "memory_free_mb": 402, "memory_total_mb": 6763, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "memory_used_percent": 96, "memory_free_mb": 402, "memory_total_mb": 6763, "top_consumer": "telemetry"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:39:35.051558Z", "cpu_5s_percent": 97, "cpu_1m_percent": 90, "cpu_5m_percent": 70, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 90, "cpu_5m_percent": 70, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:37:35.053757Z", "memory_used_percent": 93, "memory_free_mb": 389, "memory_total_mb": 2094, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 389, "memory_total_mb": 2094, "top_consumer": "http"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:23:35.055169Z", "memory_used_percent": 84, "memory_free_mb": 225, "memory_total_mb": 5039, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "memory_used_percent": 84, "memory_free_mb": 225, "memory_total_mb": 5039, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:36:35.053766Z", "memory_used_percent": 90, "memory_free_mb": 212, "memory_total_mb": 4732, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 212, "memory_total_mb": 4732, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:11:35.060882Z", "process": "qfp", "pid": 2104, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "qfp", "pid": 2104, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:21:35.049000Z", "cpu_5s_percent": 94, "cpu_1m_percent": 89, "cpu_5m_percent": 75, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 89, "cpu_5m_percent": 75, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:25:35.052676Z", "memory_used_percent": 91, "memory_free_mb": 333, "memory_total_mb": 4099, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 333, "memory_total_mb": 4099, "top_consumer": "qos"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:29:35.048764Z", "cpu_5s_percent": 89, "cpu_1m_percent": 79, "cpu_5m_percent": 86, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "cpu_5s_percent": 89, "cpu_1m_percent": 79, "cpu_5m_percent": 86, "top_process": "BGP Scanner"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:27:35.050504Z", "cpu_5s_percent": 86, "cpu_1m_percent": 75, "cpu_5m_percent": 71, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 75, "cpu_5m_percent": 71, "top_process": "CEF RP"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:16:35.052788Z", "memory_used_percent": 93, "memory_free_mb": 467, "memory_total_mb": 7770, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 467, "memory_total_mb": 7770, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:55:35.049938Z", "cpu_5s_percent": 89, "cpu_1m_percent": 87, "cpu_5m_percent": 71, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 87, "cpu_5m_percent": 71, "top_process": "Net Background"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:33:35.052311Z", "memory_used_percent": 98, "memory_free_mb": 346, "memory_total_mb": 6922, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "memory_used_percent": 98, "memory_free_mb": 346, "memory_total_mb": 6922, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:40:35.058629Z", "process": "snmpd", "pid": 2412, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 2412, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:09:35.049515Z", "cpu_5s_percent": 97, "cpu_1m_percent": 85, "cpu_5m_percent": 65, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 85, "cpu_5m_percent": 65, "top_process": "Net Background"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:49:35.055893Z", "memory_used_percent": 99, "memory_free_mb": 82, "memory_total_mb": 7216, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 82, "memory_total_mb": 7216, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:26:35.051216Z", "cpu_5s_percent": 94, "cpu_1m_percent": 95, "cpu_5m_percent": 95, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 94, "cpu_1m_percent": 95, "cpu_5m_percent": 95, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:54:35.051360Z", "cpu_5s_percent": 89, "cpu_1m_percent": 81, "cpu_5m_percent": 84, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 89, "cpu_1m_percent": 81, "cpu_5m_percent": 84, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:45:35.051331Z", "cpu_5s_percent": 97, "cpu_1m_percent": 86, "cpu_5m_percent": 66, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 86, "cpu_5m_percent": 66, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:56:35.058059Z", "process": "netconf", "pid": 400, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "netconf", "pid": 400, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:20:35.058386Z", "process": "qfp", "pid": 4196, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "qfp", "pid": 4196, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:42:35.060136Z", "process": "telemetry", "pid": 2370, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "process": "telemetry", "pid": 2370, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:24:35.053034Z", "memory_used_percent": 82, "memory_free_mb": 345, "memory_total_mb": 1857, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 345, "memory_total_mb": 1857, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:44:35.052863Z", "memory_used_percent": 97, "memory_free_mb": 354, "memory_total_mb": 6251, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "memory_used_percent": 97, "memory_free_mb": 354, "memory_total_mb": 6251, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:37:35.057278Z", "process": "ospf", "pid": 360, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 360, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:06:35.049684Z", "cpu_5s_percent": 92, "cpu_1m_percent": 99, "cpu_5m_percent": 81, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 99, "cpu_5m_percent": 81, "top_process": "CEF RP"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:01:35.053363Z", "memory_used_percent": 93, "memory_free_mb": 472, "memory_total_mb": 2759, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 472, "memory_total_mb": 2759, "top_consumer": "logging"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:37:35.052825Z", "memory_used_percent": 94, "memory_free_mb": 412, "memory_total_mb": 2741, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 412, "memory_total_mb": 2741, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:45:35.056603Z", "process": "iosd", "pid": 3137, "crash_count_24h": 4, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3137, "crash_count_24h": 4, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:21:35.052917Z", "memory_used_percent": 96, "memory_free_mb": 127, "memory_total_mb": 3849, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "memory_used_percent": 96, "memory_free_mb": 127, "memory_total_mb": 3849, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:45:35.057870Z", "process": "qfp", "pid": 3360, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "qfp", "pid": 3360, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:53:35.059263Z", "process": "bgp", "pid": 294, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "bgp", "pid": 294, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:53:35.049085Z", "cpu_5s_percent": 89, "cpu_1m_percent": 88, "cpu_5m_percent": 69, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 88, "cpu_5m_percent": 69, "top_process": "Hulc LED Process"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:26:35.048894Z", "cpu_5s_percent": 92, "cpu_1m_percent": 81, "cpu_5m_percent": 71, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 92, "cpu_1m_percent": 81, "cpu_5m_percent": 71, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T00:46:35.049264Z", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 93, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 93, "top_process": "BGP Scanner"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:17:35.052617Z", "memory_used_percent": 98, "memory_free_mb": 123, "memory_total_mb": 7186, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 123, "memory_total_mb": 7186, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:23:35.051749Z", "cpu_5s_percent": 97, "cpu_1m_percent": 77, "cpu_5m_percent": 86, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 77, "cpu_5m_percent": 86, "top_process": "CEF RP"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:26:35.052969Z", "memory_used_percent": 83, "memory_free_mb": 396, "memory_total_mb": 7578, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 396, "memory_total_mb": 7578, "top_consumer": "snmp"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:43:35.053308Z", "memory_used_percent": 82, "memory_free_mb": 374, "memory_total_mb": 7533, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 374, "memory_total_mb": 7533, "top_consumer": "ospf"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:01:35.054920Z", "memory_used_percent": 83, "memory_free_mb": 53, "memory_total_mb": 5214, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "memory_used_percent": 83, "memory_free_mb": 53, "memory_total_mb": 5214, "top_consumer": "cef"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:42:35.051519Z", "cpu_5s_percent": 92, "cpu_1m_percent": 95, "cpu_5m_percent": 72, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "cpu_5s_percent": 92, "cpu_1m_percent": 95, "cpu_5m_percent": 72, "top_process": "Hulc LED Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:53:35.053467Z", "memory_used_percent": 84, "memory_free_mb": 260, "memory_total_mb": 6070, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "memory_used_percent": 84, "memory_free_mb": 260, "memory_total_mb": 6070, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:07:35.049213Z", "cpu_5s_percent": 89, "cpu_1m_percent": 81, "cpu_5m_percent": 78, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 81, "cpu_5m_percent": 78, "top_process": "Crypto IKEv2"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:15:35.055037Z", "memory_used_percent": 93, "memory_free_mb": 77, "memory_total_mb": 8157, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 77, "memory_total_mb": 8157, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:15:35.050373Z", "cpu_5s_percent": 88, "cpu_1m_percent": 85, "cpu_5m_percent": 78, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 85, "cpu_5m_percent": 78, "top_process": "CEF RP"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:47:35.055673Z", "memory_used_percent": 96, "memory_free_mb": 451, "memory_total_mb": 7551, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 451, "memory_total_mb": 7551, "top_consumer": "crypto"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:07:35.056822Z", "process": "iosd", "pid": 918, "crash_count_24h": 25, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "process": "iosd", "pid": 918, "crash_count_24h": 25, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:29:35.054674Z", "memory_used_percent": 95, "memory_free_mb": 343, "memory_total_mb": 2954, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "memory_used_percent": 95, "memory_free_mb": 343, "memory_total_mb": 2954, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:32:35.055774Z", "memory_used_percent": 89, "memory_free_mb": 161, "memory_total_mb": 7189, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 161, "memory_total_mb": 7189, "top_consumer": "telemetry"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:35:35.055439Z", "memory_used_percent": 97, "memory_free_mb": 379, "memory_total_mb": 4125, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 379, "memory_total_mb": 4125, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:33:35.059900Z", "process": "qfp", "pid": 3526, "crash_count_24h": 7, "last_crash_reason": "Memory corruption", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "qfp", "pid": 3526, "crash_count_24h": 7, "last_crash_reason": "Memory corruption"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:45:35.056390Z", "process": "snmpd", "pid": 4299, "crash_count_24h": 3, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "snmpd", "pid": 4299, "crash_count_24h": 3, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:10:35.055740Z", "memory_used_percent": 98, "memory_free_mb": 331, "memory_total_mb": 3957, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 331, "memory_total_mb": 3957, "top_consumer": "ospf"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:42:35.057543Z", "process": "netconf", "pid": 4965, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4965, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:59:35.054851Z", "memory_used_percent": 80, "memory_free_mb": 173, "memory_total_mb": 4075, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "memory_used_percent": 80, "memory_free_mb": 173, "memory_total_mb": 4075, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:09:35.053449Z", "memory_used_percent": 84, "memory_free_mb": 245, "memory_total_mb": 7360, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 245, "memory_total_mb": 7360, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:54:35.059055Z", "process": "ospf", "pid": 2376, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "process": "ospf", "pid": 2376, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:09:35.056678Z", "process": "crypto", "pid": 2211, "crash_count_24h": 19, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 2211, "crash_count_24h": 19, "last_crash_reason": "Memory corruption"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:33:35.059016Z", "process": "snmpd", "pid": 389, "crash_count_24h": 24, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 389, "crash_count_24h": 24, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:34:35.057188Z", "process": "qfp", "pid": 848, "crash_count_24h": 23, "last_crash_reason": "Memory corruption", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "qfp", "pid": 848, "crash_count_24h": 23, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:04:35.050454Z", "cpu_5s_percent": 89, "cpu_1m_percent": 98, "cpu_5m_percent": 85, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 89, "cpu_1m_percent": 98, "cpu_5m_percent": 85, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:05:35.056546Z", "process": "crypto", "pid": 1065, "crash_count_24h": 18, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "process": "crypto", "pid": 1065, "crash_count_24h": 18, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:59:35.057485Z", "process": "crypto", "pid": 1908, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1908, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:18:35.050583Z", "cpu_5s_percent": 90, "cpu_1m_percent": 94, "cpu_5m_percent": 69, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 94, "cpu_5m_percent": 69, "top_process": "SNMP ENGINE"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:47:35.058783Z", "process": "crypto", "pid": 535, "crash_count_24h": 2, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 535, "crash_count_24h": 2, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:26:35.048981Z", "cpu_5s_percent": 86, "cpu_1m_percent": 94, "cpu_5m_percent": 67, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "cpu_5s_percent": 86, "cpu_1m_percent": 94, "cpu_5m_percent": 67, "top_process": "QoS Stats"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:21:35.054556Z", "memory_used_percent": 82, "memory_free_mb": 223, "memory_total_mb": 5890, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "memory_used_percent": 82, "memory_free_mb": 223, "memory_total_mb": 5890, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:59:35.054378Z", "memory_used_percent": 91, "memory_free_mb": 340, "memory_total_mb": 5641, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 340, "memory_total_mb": 5641, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:00:35.053298Z", "memory_used_percent": 92, "memory_free_mb": 300, "memory_total_mb": 2188, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 300, "memory_total_mb": 2188, "top_consumer": "telemetry"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:45:35.052515Z", "memory_used_percent": 92, "memory_free_mb": 90, "memory_total_mb": 4080, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 90, "memory_total_mb": 4080, "top_consumer": "qos"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:36:35.054453Z", "memory_used_percent": 99, "memory_free_mb": 452, "memory_total_mb": 3947, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "memory_used_percent": 99, "memory_free_mb": 452, "memory_total_mb": 3947, "top_consumer": "http"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:20:35.053394Z", "memory_used_percent": 94, "memory_free_mb": 50, "memory_total_mb": 4528, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 50, "memory_total_mb": 4528, "top_consumer": "http"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:16:35.058681Z", "process": "telemetry", "pid": 4746, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 4746, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:39:35.054188Z", "memory_used_percent": 91, "memory_free_mb": 401, "memory_total_mb": 6187, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 401, "memory_total_mb": 6187, "top_consumer": "ospf"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:06:35.048936Z", "cpu_5s_percent": 94, "cpu_1m_percent": 88, "cpu_5m_percent": 87, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 88, "cpu_5m_percent": 87, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:15:35.048738Z", "cpu_5s_percent": 85, "cpu_1m_percent": 94, "cpu_5m_percent": 75, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 94, "cpu_5m_percent": 75, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:12:35.055512Z", "memory_used_percent": 83, "memory_free_mb": 73, "memory_total_mb": 2368, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 73, "memory_total_mb": 2368, "top_consumer": "logging"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:58:35.055448Z", "memory_used_percent": 98, "memory_free_mb": 279, "memory_total_mb": 1745, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 279, "memory_total_mb": 1745, "top_consumer": "logging"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:56:35.052844Z", "memory_used_percent": 93, "memory_free_mb": 454, "memory_total_mb": 4112, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "memory_used_percent": 93, "memory_free_mb": 454, "memory_total_mb": 4112, "top_consumer": "ospf"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:24:35.055467Z", "memory_used_percent": 82, "memory_free_mb": 455, "memory_total_mb": 5973, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 455, "memory_total_mb": 5973, "top_consumer": "telemetry"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:56:35.051497Z", "cpu_5s_percent": 93, "cpu_1m_percent": 98, "cpu_5m_percent": 80, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 98, "cpu_5m_percent": 80, "top_process": "Net Background"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:53:35.057811Z", "process": "netconf", "pid": 3848, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "process": "netconf", "pid": 3848, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:50:35.054882Z", "memory_used_percent": 86, "memory_free_mb": 187, "memory_total_mb": 6361, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "memory_used_percent": 86, "memory_free_mb": 187, "memory_total_mb": 6361, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:33:35.056699Z", "process": "telemetry", "pid": 1905, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "telemetry", "pid": 1905, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:38:35.052074Z", "memory_used_percent": 81, "memory_free_mb": 226, "memory_total_mb": 6294, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 226, "memory_total_mb": 6294, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T10:30:35.050848Z", "cpu_5s_percent": 100, "cpu_1m_percent": 89, "cpu_5m_percent": 84, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 100, "cpu_1m_percent": 89, "cpu_5m_percent": 84, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:06:35.057795Z", "process": "iosd", "pid": 1761, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 1761, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:22:35.054900Z", "memory_used_percent": 89, "memory_free_mb": 414, "memory_total_mb": 6835, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "memory_used_percent": 89, "memory_free_mb": 414, "memory_total_mb": 6835, "top_consumer": "crypto"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:21:35.057534Z", "process": "ospf", "pid": 1021, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "process": "ospf", "pid": 1021, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:28:35.059688Z", "process": "bgp", "pid": 1569, "crash_count_24h": 4, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "bgp", "pid": 1569, "crash_count_24h": 4, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:32:35.058537Z", "process": "telemetry", "pid": 540, "crash_count_24h": 4, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "telemetry", "pid": 540, "crash_count_24h": 4, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:07:35.052278Z", "memory_used_percent": 95, "memory_free_mb": 439, "memory_total_mb": 7903, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 439, "memory_total_mb": 7903, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:44:35.050333Z", "cpu_5s_percent": 86, "cpu_1m_percent": 90, "cpu_5m_percent": 92, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 90, "cpu_5m_percent": 92, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:20:35.052686Z", "memory_used_percent": 99, "memory_free_mb": 201, "memory_total_mb": 7561, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 201, "memory_total_mb": 7561, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:54:35.056344Z", "process": "crypto", "pid": 2400, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 2400, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:19:35.053383Z", "memory_used_percent": 83, "memory_free_mb": 370, "memory_total_mb": 7445, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 370, "memory_total_mb": 7445, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:55:35.057223Z", "process": "qfp", "pid": 4679, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "qfp", "pid": 4679, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:55:35.048873Z", "cpu_5s_percent": 86, "cpu_1m_percent": 96, "cpu_5m_percent": 85, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 96, "cpu_5m_percent": 85, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:10:35.054962Z", "memory_used_percent": 80, "memory_free_mb": 385, "memory_total_mb": 5098, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "memory_used_percent": 80, "memory_free_mb": 385, "memory_total_mb": 5098, "top_consumer": "crypto"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:26:35.058092Z", "process": "ospf", "pid": 2551, "crash_count_24h": 12, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 2551, "crash_count_24h": 12, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:45:35.049180Z", "cpu_5s_percent": 88, "cpu_1m_percent": 87, "cpu_5m_percent": 93, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 87, "cpu_5m_percent": 93, "top_process": "Hulc LED Process"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:47:35.057849Z", "process": "crypto", "pid": 4506, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "crypto", "pid": 4506, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:33:35.048916Z", "cpu_5s_percent": 85, "cpu_1m_percent": 77, "cpu_5m_percent": 94, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 77, "cpu_5m_percent": 94, "top_process": "SSH Process"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:30:35.050142Z", "cpu_5s_percent": 87, "cpu_1m_percent": 84, "cpu_5m_percent": 75, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "cpu_5s_percent": 87, "cpu_1m_percent": 84, "cpu_5m_percent": 75, "top_process": "OSPF-1 Router"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:00:35.056668Z", "process": "rp", "pid": 1533, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "rp", "pid": 1533, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:11:35.051178Z", "cpu_5s_percent": 93, "cpu_1m_percent": 81, "cpu_5m_percent": 85, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 81, "cpu_5m_percent": 85, "top_process": "BGP Scanner"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:42:35.054948Z", "memory_used_percent": 87, "memory_free_mb": 79, "memory_total_mb": 7622, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "memory_used_percent": 87, "memory_free_mb": 79, "memory_total_mb": 7622, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:56:35.054872Z", "memory_used_percent": 92, "memory_free_mb": 75, "memory_total_mb": 2358, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 75, "memory_total_mb": 2358, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:54:35.051390Z", "cpu_5s_percent": 95, "cpu_1m_percent": 91, "cpu_5m_percent": 91, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 95, "cpu_1m_percent": 91, "cpu_5m_percent": 91, "top_process": "Crypto IKEv2"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:58:35.056959Z", "process": "ospf", "pid": 1825, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "process": "ospf", "pid": 1825, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:05:35.058800Z", "process": "telemetry", "pid": 2706, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 2706, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:13:35.054504Z", "memory_used_percent": 87, "memory_free_mb": 404, "memory_total_mb": 1579, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 404, "memory_total_mb": 1579, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:08:35.050274Z", "cpu_5s_percent": 91, "cpu_1m_percent": 77, "cpu_5m_percent": 91, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 77, "cpu_5m_percent": 91, "top_process": "OSPF-1 Router"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:50:35.056892Z", "process": "telemetry", "pid": 2447, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "telemetry", "pid": 2447, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:21:35.055093Z", "memory_used_percent": 81, "memory_free_mb": 323, "memory_total_mb": 2657, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 323, "memory_total_mb": 2657, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:19:35.060153Z", "process": "crypto", "pid": 1105, "crash_count_24h": 17, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "process": "crypto", "pid": 1105, "crash_count_24h": 17, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:40:35.053599Z", "memory_used_percent": 80, "memory_free_mb": 133, "memory_total_mb": 5090, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "memory_used_percent": 80, "memory_free_mb": 133, "memory_total_mb": 5090, "top_consumer": "cef"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:47:35.056325Z", "process": "ospf", "pid": 4332, "crash_count_24h": 10, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "process": "ospf", "pid": 4332, "crash_count_24h": 10, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:21:35.057251Z", "process": "netconf", "pid": 2056, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "netconf", "pid": 2056, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:31:35.053017Z", "memory_used_percent": 94, "memory_free_mb": 353, "memory_total_mb": 4542, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 353, "memory_total_mb": 4542, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:44:35.053553Z", "memory_used_percent": 96, "memory_free_mb": 442, "memory_total_mb": 4427, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "memory_used_percent": 96, "memory_free_mb": 442, "memory_total_mb": 4427, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:24:35.056831Z", "process": "snmpd", "pid": 1325, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 1325, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:39:35.051616Z", "cpu_5s_percent": 93, "cpu_1m_percent": 85, "cpu_5m_percent": 74, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 85, "cpu_5m_percent": 74, "top_process": "Net Background"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:31:35.058736Z", "process": "bgp", "pid": 1301, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "bgp", "pid": 1301, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:57:35.055884Z", "memory_used_percent": 92, "memory_free_mb": 271, "memory_total_mb": 3615, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 271, "memory_total_mb": 3615, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:43:35.051676Z", "cpu_5s_percent": 89, "cpu_1m_percent": 80, "cpu_5m_percent": 75, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 80, "cpu_5m_percent": 75, "top_process": "Hulc LED Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:21:35.054971Z", "memory_used_percent": 81, "memory_free_mb": 348, "memory_total_mb": 6824, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 348, "memory_total_mb": 6824, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:30:35.057979Z", "process": "rp", "pid": 2635, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "rp", "pid": 2635, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T10:06:35.051197Z", "cpu_5s_percent": 95, "cpu_1m_percent": 93, "cpu_5m_percent": 66, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "cpu_5s_percent": 95, "cpu_1m_percent": 93, "cpu_5m_percent": 66, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:16:35.050019Z", "cpu_5s_percent": 97, "cpu_1m_percent": 85, "cpu_5m_percent": 85, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 97, "cpu_1m_percent": 85, "cpu_5m_percent": 85, "top_process": "Hulc LED Process"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:33:35.053590Z", "memory_used_percent": 99, "memory_free_mb": 78, "memory_total_mb": 3557, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "memory_used_percent": 99, "memory_free_mb": 78, "memory_total_mb": 3557, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:16:35.056213Z", "process": "iosd", "pid": 2256, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "process": "iosd", "pid": 2256, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:56:35.050838Z", "cpu_5s_percent": 95, "cpu_1m_percent": 79, "cpu_5m_percent": 69, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 79, "cpu_5m_percent": 69, "top_process": "BGP Scanner"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:48:35.052797Z", "memory_used_percent": 86, "memory_free_mb": 295, "memory_total_mb": 3597, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "memory_used_percent": 86, "memory_free_mb": 295, "memory_total_mb": 3597, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T10:08:35.050820Z", "cpu_5s_percent": 99, "cpu_1m_percent": 86, "cpu_5m_percent": 94, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 86, "cpu_5m_percent": 94, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:41:35.053161Z", "memory_used_percent": 84, "memory_free_mb": 145, "memory_total_mb": 3601, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 145, "memory_total_mb": 3601, "top_consumer": "logging"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:29:35.049306Z", "cpu_5s_percent": 99, "cpu_1m_percent": 80, "cpu_5m_percent": 88, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 80, "cpu_5m_percent": 88, "top_process": "Hulc LED Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:17:35.050493Z", "cpu_5s_percent": 88, "cpu_1m_percent": 84, "cpu_5m_percent": 86, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 84, "cpu_5m_percent": 86, "top_process": "CEF RP"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:21:35.060094Z", "process": "ospf", "pid": 3237, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 3237, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:53:35.056155Z", "process": "qfp", "pid": 2810, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "qfp", "pid": 2810, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:18:35.053563Z", "memory_used_percent": 99, "memory_free_mb": 128, "memory_total_mb": 3297, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "memory_used_percent": 99, "memory_free_mb": 128, "memory_total_mb": 3297, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:33:35.053508Z", "memory_used_percent": 96, "memory_free_mb": 146, "memory_total_mb": 7150, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "memory_used_percent": 96, "memory_free_mb": 146, "memory_total_mb": 7150, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:14:35.050232Z", "cpu_5s_percent": 98, "cpu_1m_percent": 95, "cpu_5m_percent": 68, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 98, "cpu_1m_percent": 95, "cpu_5m_percent": 68, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:56:35.049988Z", "cpu_5s_percent": 89, "cpu_1m_percent": 91, "cpu_5m_percent": 95, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 91, "cpu_5m_percent": 95, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:53:35.049526Z", "cpu_5s_percent": 95, "cpu_1m_percent": 83, "cpu_5m_percent": 93, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 83, "cpu_5m_percent": 93, "top_process": "Crypto IKEv2"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:04:35.057006Z", "process": "crypto", "pid": 2636, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "process": "crypto", "pid": 2636, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:39:35.059450Z", "process": "netconf", "pid": 2831, "crash_count_24h": 23, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "process": "netconf", "pid": 2831, "crash_count_24h": 23, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:58:35.054328Z", "memory_used_percent": 91, "memory_free_mb": 339, "memory_total_mb": 5139, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 339, "memory_total_mb": 5139, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:23:35.053517Z", "memory_used_percent": 92, "memory_free_mb": 107, "memory_total_mb": 2998, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 107, "memory_total_mb": 2998, "top_consumer": "logging"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:46:35.049823Z", "cpu_5s_percent": 87, "cpu_1m_percent": 82, "cpu_5m_percent": 95, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 87, "cpu_1m_percent": 82, "cpu_5m_percent": 95, "top_process": "IP Input"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:26:35.057156Z", "process": "ospf", "pid": 2175, "crash_count_24h": 17, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "process": "ospf", "pid": 2175, "crash_count_24h": 17, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:27:35.054891Z", "memory_used_percent": 84, "memory_free_mb": 381, "memory_total_mb": 2442, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 381, "memory_total_mb": 2442, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:15:35.057179Z", "process": "iosd", "pid": 173, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 173, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:47:35.060669Z", "process": "rp", "pid": 1957, "crash_count_24h": 17, "last_crash_reason": "Memory corruption", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "rp", "pid": 1957, "crash_count_24h": 17, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:03:35.050603Z", "cpu_5s_percent": 99, "cpu_1m_percent": 77, "cpu_5m_percent": 80, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 99, "cpu_1m_percent": 77, "cpu_5m_percent": 80, "top_process": "OSPF-1 Router"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T00:56:35.053212Z", "memory_used_percent": 97, "memory_free_mb": 197, "memory_total_mb": 2401, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 197, "memory_total_mb": 2401, "top_consumer": "logging"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:32:35.057232Z", "process": "netconf", "pid": 3937, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 3937, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:39:35.054735Z", "memory_used_percent": 84, "memory_free_mb": 125, "memory_total_mb": 5665, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 125, "memory_total_mb": 5665, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:35:35.049358Z", "cpu_5s_percent": 97, "cpu_1m_percent": 90, "cpu_5m_percent": 65, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 97, "cpu_1m_percent": 90, "cpu_5m_percent": 65, "top_process": "IP Input"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:22:35.050717Z", "cpu_5s_percent": 87, "cpu_1m_percent": 95, "cpu_5m_percent": 86, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 95, "cpu_5m_percent": 86, "top_process": "SSH Process"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:20:35.054166Z", "memory_used_percent": 94, "memory_free_mb": 334, "memory_total_mb": 7152, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 334, "memory_total_mb": 7152, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:39:35.051856Z", "cpu_5s_percent": 86, "cpu_1m_percent": 79, "cpu_5m_percent": 81, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 79, "cpu_5m_percent": 81, "top_process": "SNMP ENGINE"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:45:35.057597Z", "process": "crypto", "pid": 456, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "process": "crypto", "pid": 456, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:14:35.055595Z", "memory_used_percent": 96, "memory_free_mb": 203, "memory_total_mb": 7930, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "memory_used_percent": 96, "memory_free_mb": 203, "memory_total_mb": 7930, "top_consumer": "netconf"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:07:35.051126Z", "cpu_5s_percent": 99, "cpu_1m_percent": 92, "cpu_5m_percent": 69, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 99, "cpu_1m_percent": 92, "cpu_5m_percent": 69, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:03:35.054388Z", "memory_used_percent": 89, "memory_free_mb": 139, "memory_total_mb": 5041, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "memory_used_percent": 89, "memory_free_mb": 139, "memory_total_mb": 5041, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:44:35.057314Z", "process": "bgp", "pid": 676, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "process": "bgp", "pid": 676, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:04:35.060691Z", "process": "iosd", "pid": 1057, "crash_count_24h": 3, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "iosd", "pid": 1057, "crash_count_24h": 3, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:52:35.056292Z", "process": "iosd", "pid": 614, "crash_count_24h": 10, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 614, "crash_count_24h": 10, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:25:35.054524Z", "memory_used_percent": 91, "memory_free_mb": 329, "memory_total_mb": 4098, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 329, "memory_total_mb": 4098, "top_consumer": "ospf"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:17:35.051732Z", "cpu_5s_percent": 98, "cpu_1m_percent": 80, "cpu_5m_percent": 89, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 80, "cpu_5m_percent": 89, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:16:35.053413Z", "memory_used_percent": 92, "memory_free_mb": 370, "memory_total_mb": 3526, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 370, "memory_total_mb": 3526, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T10:33:35.049948Z", "cpu_5s_percent": 95, "cpu_1m_percent": 91, "cpu_5m_percent": 73, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 91, "cpu_5m_percent": 73, "top_process": "CEF RP"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:42:35.054909Z", "memory_used_percent": 88, "memory_free_mb": 161, "memory_total_mb": 4847, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 161, "memory_total_mb": 4847, "top_consumer": "crypto"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:57:35.052695Z", "memory_used_percent": 92, "memory_free_mb": 414, "memory_total_mb": 7445, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 414, "memory_total_mb": 7445, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:59:35.049496Z", "cpu_5s_percent": 90, "cpu_1m_percent": 98, "cpu_5m_percent": 81, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 90, "cpu_1m_percent": 98, "cpu_5m_percent": 81, "top_process": "CEF RP"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:08:35.049031Z", "cpu_5s_percent": 85, "cpu_1m_percent": 96, "cpu_5m_percent": 91, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 85, "cpu_1m_percent": 96, "cpu_5m_percent": 91, "top_process": "SSH Process"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:29:35.055623Z", "memory_used_percent": 98, "memory_free_mb": 342, "memory_total_mb": 6489, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 342, "memory_total_mb": 6489, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:52:35.051814Z", "cpu_5s_percent": 92, "cpu_1m_percent": 81, "cpu_5m_percent": 67, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 92, "cpu_1m_percent": 81, "cpu_5m_percent": 67, "top_process": "IP Input"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:13:35.053102Z", "memory_used_percent": 87, "memory_free_mb": 206, "memory_total_mb": 1982, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 206, "memory_total_mb": 1982, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:30:35.054929Z", "memory_used_percent": 89, "memory_free_mb": 400, "memory_total_mb": 1909, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 400, "memory_total_mb": 1909, "top_consumer": "logging"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:18:35.050162Z", "cpu_5s_percent": 95, "cpu_1m_percent": 78, "cpu_5m_percent": 79, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 78, "cpu_5m_percent": 79, "top_process": "Crypto IKEv2"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:43:35.055228Z", "memory_used_percent": 80, "memory_free_mb": 204, "memory_total_mb": 4471, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 204, "memory_total_mb": 4471, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:23:35.049875Z", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 66, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 66, "top_process": "IP Input"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:05:35.054637Z", "memory_used_percent": 97, "memory_free_mb": 248, "memory_total_mb": 2538, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 248, "memory_total_mb": 2538, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:06:35.058518Z", "process": "netconf", "pid": 4528, "crash_count_24h": 16, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "process": "netconf", "pid": 4528, "crash_count_24h": 16, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:36:35.052502Z", "memory_used_percent": 84, "memory_free_mb": 173, "memory_total_mb": 2596, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "memory_used_percent": 84, "memory_free_mb": 173, "memory_total_mb": 2596, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:39:35.049912Z", "cpu_5s_percent": 98, "cpu_1m_percent": 77, "cpu_5m_percent": 72, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 98, "cpu_1m_percent": 77, "cpu_5m_percent": 72, "top_process": "Hulc LED Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T00:55:35.053627Z", "memory_used_percent": 96, "memory_free_mb": 234, "memory_total_mb": 1478, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 234, "memory_total_mb": 1478, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:46:35.051145Z", "cpu_5s_percent": 99, "cpu_1m_percent": 89, "cpu_5m_percent": 86, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 89, "cpu_5m_percent": 86, "top_process": "BGP Scanner"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:39:35.055120Z", "memory_used_percent": 89, "memory_free_mb": 198, "memory_total_mb": 4758, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 198, "memory_total_mb": 4758, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:39:35.058191Z", "process": "rp", "pid": 1685, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "process": "rp", "pid": 1685, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:03:35.054118Z", "memory_used_percent": 93, "memory_free_mb": 111, "memory_total_mb": 5414, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 111, "memory_total_mb": 5414, "top_consumer": "cef"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:31:35.053354Z", "memory_used_percent": 94, "memory_free_mb": 375, "memory_total_mb": 6464, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "memory_used_percent": 94, "memory_free_mb": 375, "memory_total_mb": 6464, "top_consumer": "cef"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:50:35.052988Z", "memory_used_percent": 85, "memory_free_mb": 145, "memory_total_mb": 6270, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "memory_used_percent": 85, "memory_free_mb": 145, "memory_total_mb": 6270, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:03:35.050624Z", "cpu_5s_percent": 87, "cpu_1m_percent": 95, "cpu_5m_percent": 92, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 95, "cpu_5m_percent": 92, "top_process": "Crypto IKEv2"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:12:35.049845Z", "cpu_5s_percent": 90, "cpu_1m_percent": 93, "cpu_5m_percent": 78, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "cpu_5s_percent": 90, "cpu_1m_percent": 93, "cpu_5m_percent": 78, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:53:35.057165Z", "process": "iosd", "pid": 3656, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "iosd", "pid": 3656, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:52:35.054348Z", "memory_used_percent": 91, "memory_free_mb": 442, "memory_total_mb": 5808, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "memory_used_percent": 91, "memory_free_mb": 442, "memory_total_mb": 5808, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:06:35.058423Z", "process": "crypto", "pid": 1048, "crash_count_24h": 2, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "process": "crypto", "pid": 1048, "crash_count_24h": 2, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:27:35.056138Z", "process": "bgp", "pid": 4596, "crash_count_24h": 16, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "bgp", "pid": 4596, "crash_count_24h": 16, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:16:35.060771Z", "process": "crypto", "pid": 3749, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "crypto", "pid": 3749, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:36:35.053203Z", "memory_used_percent": 80, "memory_free_mb": 457, "memory_total_mb": 7258, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "memory_used_percent": 80, "memory_free_mb": 457, "memory_total_mb": 7258, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:40:35.054725Z", "memory_used_percent": 96, "memory_free_mb": 284, "memory_total_mb": 8179, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 284, "memory_total_mb": 8179, "top_consumer": "bgp"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:13:35.057552Z", "process": "snmpd", "pid": 3708, "crash_count_24h": 3, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3708, "crash_count_24h": 3, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:41:35.055018Z", "memory_used_percent": 94, "memory_free_mb": 485, "memory_total_mb": 1988, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 485, "memory_total_mb": 1988, "top_consumer": "logging"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:31:35.051003Z", "cpu_5s_percent": 98, "cpu_1m_percent": 77, "cpu_5m_percent": 78, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 77, "cpu_5m_percent": 78, "top_process": "BGP Scanner"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:49:35.058075Z", "process": "telemetry", "pid": 1560, "crash_count_24h": 7, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "telemetry", "pid": 1560, "crash_count_24h": 7, "last_crash_reason": "Memory corruption"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:27:35.057760Z", "process": "qfp", "pid": 1198, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "qfp", "pid": 1198, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:51:35.048044Z", "cpu_5s_percent": 96, "cpu_1m_percent": 94, "cpu_5m_percent": 73, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 94, "cpu_5m_percent": 73, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:35:35.055419Z", "memory_used_percent": 80, "memory_free_mb": 379, "memory_total_mb": 2309, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 379, "memory_total_mb": 2309, "top_consumer": "netconf"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:52:35.050524Z", "cpu_5s_percent": 96, "cpu_1m_percent": 77, "cpu_5m_percent": 77, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 77, "cpu_5m_percent": 77, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:01:35.060607Z", "process": "crypto", "pid": 1181, "crash_count_24h": 17, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1181, "crash_count_24h": 17, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:58:35.050747Z", "cpu_5s_percent": 89, "cpu_1m_percent": 94, "cpu_5m_percent": 77, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "cpu_5s_percent": 89, "cpu_1m_percent": 94, "cpu_5m_percent": 77, "top_process": "QoS Stats"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:14:35.057641Z", "process": "bgp", "pid": 425, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "process": "bgp", "pid": 425, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:40:35.051036Z", "cpu_5s_percent": 87, "cpu_1m_percent": 96, "cpu_5m_percent": 85, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 96, "cpu_5m_percent": 85, "top_process": "IP Input"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:01:35.055330Z", "memory_used_percent": 85, "memory_free_mb": 218, "memory_total_mb": 3952, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 218, "memory_total_mb": 3952, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:01:35.048167Z", "cpu_5s_percent": 98, "cpu_1m_percent": 94, "cpu_5m_percent": 67, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "cpu_5s_percent": 98, "cpu_1m_percent": 94, "cpu_5m_percent": 67, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:58:35.055849Z", "memory_used_percent": 93, "memory_free_mb": 381, "memory_total_mb": 7714, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "memory_used_percent": 93, "memory_free_mb": 381, "memory_total_mb": 7714, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:55:35.049704Z", "cpu_5s_percent": 93, "cpu_1m_percent": 96, "cpu_5m_percent": 67, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 96, "cpu_5m_percent": 67, "top_process": "SNMP ENGINE"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:56:35.049336Z", "cpu_5s_percent": 97, "cpu_1m_percent": 97, "cpu_5m_percent": 69, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 97, "cpu_5m_percent": 69, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:52:35.055756Z", "memory_used_percent": 96, "memory_free_mb": 84, "memory_total_mb": 7465, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 84, "memory_total_mb": 7465, "top_consumer": "netconf"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:33:35.055027Z", "memory_used_percent": 82, "memory_free_mb": 291, "memory_total_mb": 2617, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "memory_used_percent": 82, "memory_free_mb": 291, "memory_total_mb": 2617, "top_consumer": "netconf"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:53:35.051303Z", "cpu_5s_percent": 100, "cpu_1m_percent": 75, "cpu_5m_percent": 67, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 75, "cpu_5m_percent": 67, "top_process": "Crypto IKEv2"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:22:35.056498Z", "process": "qfp", "pid": 419, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "qfp", "pid": 419, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:53:35.057832Z", "process": "netconf", "pid": 3328, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "process": "netconf", "pid": 3328, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:28:35.054982Z", "memory_used_percent": 97, "memory_free_mb": 376, "memory_total_mb": 7453, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "memory_used_percent": 97, "memory_free_mb": 376, "memory_total_mb": 7453, "top_consumer": "logging"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:58:35.050413Z", "cpu_5s_percent": 88, "cpu_1m_percent": 93, "cpu_5m_percent": 81, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 88, "cpu_1m_percent": 93, "cpu_5m_percent": 81, "top_process": "ARP Input"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:43:35.060701Z", "process": "iosd", "pid": 4707, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "iosd", "pid": 4707, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:22:35.059584Z", "process": "bgp", "pid": 3960, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "process": "bgp", "pid": 3960, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:10:35.060713Z", "process": "crypto", "pid": 1431, "crash_count_24h": 19, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1431, "crash_count_24h": 19, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:32:35.051667Z", "cpu_5s_percent": 87, "cpu_1m_percent": 93, "cpu_5m_percent": 68, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 87, "cpu_1m_percent": 93, "cpu_5m_percent": 68, "top_process": "ARP Input"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:31:35.058173Z", "process": "snmpd", "pid": 4709, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4709, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:14:35.050264Z", "cpu_5s_percent": 91, "cpu_1m_percent": 95, "cpu_5m_percent": 85, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 95, "cpu_5m_percent": 85, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:27:35.049589Z", "cpu_5s_percent": 95, "cpu_1m_percent": 78, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 78, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:24:35.059330Z", "process": "bgp", "pid": 2215, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 2215, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:28:35.052949Z", "memory_used_percent": 86, "memory_free_mb": 316, "memory_total_mb": 4980, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 316, "memory_total_mb": 4980, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:44:35.057137Z", "process": "qfp", "pid": 2124, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "qfp", "pid": 2124, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:46:35.050670Z", "cpu_5s_percent": 96, "cpu_1m_percent": 86, "cpu_5m_percent": 94, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "cpu_5s_percent": 96, "cpu_1m_percent": 86, "cpu_5m_percent": 94, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:12:35.050829Z", "cpu_5s_percent": 92, "cpu_1m_percent": 87, "cpu_5m_percent": 67, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 87, "cpu_5m_percent": 67, "top_process": "ARP Input"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:00:35.056114Z", "process": "telemetry", "pid": 4500, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "process": "telemetry", "pid": 4500, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:29:35.050896Z", "cpu_5s_percent": 96, "cpu_1m_percent": 82, "cpu_5m_percent": 83, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 82, "cpu_5m_percent": 83, "top_process": "IP Input"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:08:35.056312Z", "process": "rp", "pid": 2257, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "process": "rp", "pid": 2257, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:03:35.050029Z", "cpu_5s_percent": 94, "cpu_1m_percent": 82, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "cpu_5s_percent": 94, "cpu_1m_percent": 82, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:40:35.060738Z", "process": "snmpd", "pid": 4730, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "process": "snmpd", "pid": 4730, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:28:35.058310Z", "process": "snmpd", "pid": 2397, "crash_count_24h": 2, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 2397, "crash_count_24h": 2, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:28:35.048126Z", "cpu_5s_percent": 95, "cpu_1m_percent": 87, "cpu_5m_percent": 73, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 87, "cpu_5m_percent": 73, "top_process": "IP Input"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:16:35.057107Z", "process": "bgp", "pid": 4143, "crash_count_24h": 8, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "bgp", "pid": 4143, "crash_count_24h": 8, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:40:35.060804Z", "process": "iosd", "pid": 3739, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "iosd", "pid": 3739, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:42:35.049316Z", "cpu_5s_percent": 93, "cpu_1m_percent": 99, "cpu_5m_percent": 89, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 99, "cpu_5m_percent": 89, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:22:35.049064Z", "cpu_5s_percent": 86, "cpu_1m_percent": 75, "cpu_5m_percent": 75, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "cpu_5s_percent": 86, "cpu_1m_percent": 75, "cpu_5m_percent": 75, "top_process": "Crypto IKEv2"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:06:35.051420Z", "cpu_5s_percent": 100, "cpu_1m_percent": 80, "cpu_5m_percent": 81, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 80, "cpu_5m_percent": 81, "top_process": "IP Input"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:51:35.059295Z", "process": "snmpd", "pid": 2175, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "process": "snmpd", "pid": 2175, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:59:35.054665Z", "memory_used_percent": 98, "memory_free_mb": 166, "memory_total_mb": 5559, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 166, "memory_total_mb": 5559, "top_consumer": "bgp"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:52:35.049243Z", "cpu_5s_percent": 87, "cpu_1m_percent": 84, "cpu_5m_percent": 81, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 87, "cpu_1m_percent": 84, "cpu_5m_percent": 81, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:24:35.056191Z", "process": "telemetry", "pid": 2366, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "process": "telemetry", "pid": 2366, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:22:35.055111Z", "memory_used_percent": 83, "memory_free_mb": 246, "memory_total_mb": 5147, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 246, "memory_total_mb": 5147, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:35:35.057018Z", "process": "telemetry", "pid": 2228, "crash_count_24h": 6, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 2228, "crash_count_24h": 6, "last_crash_reason": "Memory corruption"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:20:35.048946Z", "cpu_5s_percent": 86, "cpu_1m_percent": 93, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 93, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:51:35.049856Z", "cpu_5s_percent": 95, "cpu_1m_percent": 96, "cpu_5m_percent": 68, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 96, "cpu_5m_percent": 68, "top_process": "ARP Input"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:50:35.050799Z", "cpu_5s_percent": 100, "cpu_1m_percent": 86, "cpu_5m_percent": 82, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 86, "cpu_5m_percent": 82, "top_process": "SSH Process"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:18:35.049052Z", "cpu_5s_percent": 93, "cpu_1m_percent": 91, "cpu_5m_percent": 80, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 93, "cpu_1m_percent": 91, "cpu_5m_percent": 80, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:24:35.054214Z", "memory_used_percent": 80, "memory_free_mb": 83, "memory_total_mb": 2643, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 83, "memory_total_mb": 2643, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:01:35.058369Z", "process": "snmpd", "pid": 1019, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 1019, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:28:35.054814Z", "memory_used_percent": 81, "memory_free_mb": 313, "memory_total_mb": 7507, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 313, "memory_total_mb": 7507, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:35:35.058702Z", "process": "qfp", "pid": 2765, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "qfp", "pid": 2765, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:55:35.048753Z", "cpu_5s_percent": 92, "cpu_1m_percent": 76, "cpu_5m_percent": 72, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 76, "cpu_5m_percent": 72, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:38:35.049446Z", "cpu_5s_percent": 96, "cpu_1m_percent": 80, "cpu_5m_percent": 84, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 80, "cpu_5m_percent": 84, "top_process": "Crypto IKEv2"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:30:35.049895Z", "cpu_5s_percent": 88, "cpu_1m_percent": 75, "cpu_5m_percent": 85, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 75, "cpu_5m_percent": 85, "top_process": "Net Background"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:20:35.058857Z", "process": "ospf", "pid": 1224, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "ospf", "pid": 1224, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:22:35.059434Z", "process": "ospf", "pid": 4524, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "process": "ospf", "pid": 4524, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:34:35.059539Z", "process": "netconf", "pid": 559, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "netconf", "pid": 559, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:54:35.054130Z", "memory_used_percent": 88, "memory_free_mb": 486, "memory_total_mb": 2006, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 486, "memory_total_mb": 2006, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:11:35.049456Z", "cpu_5s_percent": 94, "cpu_1m_percent": 93, "cpu_5m_percent": 86, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 93, "cpu_5m_percent": 86, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:50:35.050099Z", "cpu_5s_percent": 88, "cpu_1m_percent": 82, "cpu_5m_percent": 77, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 82, "cpu_5m_percent": 77, "top_process": "Net Background"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:40:35.050935Z", "cpu_5s_percent": 90, "cpu_1m_percent": 99, "cpu_5m_percent": 86, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 99, "cpu_5m_percent": 86, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:14:35.050049Z", "cpu_5s_percent": 94, "cpu_1m_percent": 86, "cpu_5m_percent": 76, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 86, "cpu_5m_percent": 76, "top_process": "IP Input"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T02:44:35.052345Z", "memory_used_percent": 95, "memory_free_mb": 420, "memory_total_mb": 6280, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 420, "memory_total_mb": 6280, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T00:47:35.051135Z", "cpu_5s_percent": 98, "cpu_1m_percent": 99, "cpu_5m_percent": 78, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 99, "cpu_5m_percent": 78, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:51:35.060761Z", "process": "netconf", "pid": 550, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "netconf", "pid": 550, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:22:35.050221Z", "cpu_5s_percent": 96, "cpu_1m_percent": 96, "cpu_5m_percent": 95, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 96, "cpu_5m_percent": 95, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T10:13:35.057401Z", "process": "bgp", "pid": 2560, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 2560, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:41:35.050079Z", "cpu_5s_percent": 85, "cpu_1m_percent": 89, "cpu_5m_percent": 93, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 89, "cpu_5m_percent": 93, "top_process": "SSH Process"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:13:35.051086Z", "cpu_5s_percent": 91, "cpu_1m_percent": 94, "cpu_5m_percent": 74, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 94, "cpu_5m_percent": 74, "top_process": "Net Background"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T04:05:35.049978Z", "cpu_5s_percent": 100, "cpu_1m_percent": 97, "cpu_5m_percent": 94, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 97, "cpu_5m_percent": 94, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:50:35.058137Z", "process": "iosd", "pid": 1812, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "process": "iosd", "pid": 1812, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:18:35.048906Z", "cpu_5s_percent": 99, "cpu_1m_percent": 82, "cpu_5m_percent": 92, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 82, "cpu_5m_percent": 92, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:06:35.052294Z", "memory_used_percent": 81, "memory_free_mb": 338, "memory_total_mb": 8102, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 338, "memory_total_mb": 8102, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:25:35.057570Z", "process": "qfp", "pid": 3959, "crash_count_24h": 2, "last_crash_reason": "Memory corruption", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "qfp", "pid": 3959, "crash_count_24h": 2, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T00:48:35.050534Z", "cpu_5s_percent": 95, "cpu_1m_percent": 93, "cpu_5m_percent": 78, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 93, "cpu_5m_percent": 78, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:28:35.052835Z", "memory_used_percent": 95, "memory_free_mb": 121, "memory_total_mb": 6212, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "memory_used_percent": 95, "memory_free_mb": 121, "memory_total_mb": 6212, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:04:35.058481Z", "process": "snmpd", "pid": 2341, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 2341, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:33:35.055272Z", "memory_used_percent": 96, "memory_free_mb": 153, "memory_total_mb": 3956, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 153, "memory_total_mb": 3956, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:18:35.056247Z", "process": "snmpd", "pid": 3096, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "process": "snmpd", "pid": 3096, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:10:35.054369Z", "memory_used_percent": 85, "memory_free_mb": 140, "memory_total_mb": 2961, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 140, "memory_total_mb": 2961, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:33:35.050192Z", "cpu_5s_percent": 88, "cpu_1m_percent": 96, "cpu_5m_percent": 72, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 88, "cpu_1m_percent": 96, "cpu_5m_percent": 72, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:50:35.060748Z", "process": "crypto", "pid": 1057, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "crypto", "pid": 1057, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:33:35.057372Z", "process": "qfp", "pid": 2986, "crash_count_24h": 12, "last_crash_reason": "Memory corruption", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "process": "qfp", "pid": 2986, "crash_count_24h": 12, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T10:18:35.052429Z", "memory_used_percent": 97, "memory_free_mb": 332, "memory_total_mb": 4393, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 332, "memory_total_mb": 4393, "top_consumer": "bgp"}], "cli_fix": ["no ip ssh logging events", "ip ssh time-out 30", "ip ssh authentication-retries 2"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:55:35.052901Z", "memory_used_percent": 98, "memory_free_mb": 163, "memory_total_mb": 4675, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "memory_used_percent": 98, "memory_free_mb": 163, "memory_total_mb": 4675, "top_consumer": "cef"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:00:35.054774Z", "memory_used_percent": 87, "memory_free_mb": 75, "memory_total_mb": 7133, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "memory_used_percent": 87, "memory_free_mb": 75, "memory_total_mb": 7133, "top_consumer": "logging"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:56:35.048723Z", "cpu_5s_percent": 88, "cpu_1m_percent": 95, "cpu_5m_percent": 74, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 88, "cpu_1m_percent": 95, "cpu_5m_percent": 74, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service tcp-small-servers", "no service udp-small-servers", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T00:56:35.050109Z", "cpu_5s_percent": 97, "cpu_1m_percent": 83, "cpu_5m_percent": 65, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 83, "cpu_5m_percent": 65, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:58:35.059558Z", "process": "crypto", "pid": 1320, "crash_count_24h": 25, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1320, "crash_count_24h": 25, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:20:35.049959Z", "cpu_5s_percent": 89, "cpu_1m_percent": 89, "cpu_5m_percent": 82, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 89, "cpu_1m_percent": 89, "cpu_5m_percent": 82, "top_process": "Net Background"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:31:35.049436Z", "cpu_5s_percent": 89, "cpu_1m_percent": 82, "cpu_5m_percent": 69, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 82, "cpu_5m_percent": 69, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:41:35.054573Z", "memory_used_percent": 85, "memory_free_mb": 360, "memory_total_mb": 4580, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "memory_used_percent": 85, "memory_free_mb": 360, "memory_total_mb": 4580, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:21:35.053720Z", "memory_used_percent": 80, "memory_free_mb": 221, "memory_total_mb": 1035, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "memory_used_percent": 80, "memory_free_mb": 221, "memory_total_mb": 1035, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:54:35.049927Z", "cpu_5s_percent": 100, "cpu_1m_percent": 97, "cpu_5m_percent": 74, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "cpu_5s_percent": 100, "cpu_1m_percent": 97, "cpu_5m_percent": 74, "top_process": "OSPF-1 Router"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:51:35.059246Z", "process": "crypto", "pid": 951, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "crypto", "pid": 951, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:26:35.058345Z", "process": "ospf", "pid": 4171, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 4171, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:07:35.057502Z", "process": "qfp", "pid": 4781, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "qfp", "pid": 4781, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:49:35.055557Z", "memory_used_percent": 98, "memory_free_mb": 138, "memory_total_mb": 7008, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "memory_used_percent": 98, "memory_free_mb": 138, "memory_total_mb": 7008, "top_consumer": "snmp"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T03:58:35.057609Z", "process": "bgp", "pid": 3908, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 3908, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:53:35.055361Z", "memory_used_percent": 83, "memory_free_mb": 263, "memory_total_mb": 5863, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 263, "memory_total_mb": 5863, "top_consumer": "logging"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:13:35.055302Z", "memory_used_percent": 82, "memory_free_mb": 420, "memory_total_mb": 6951, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "memory_used_percent": 82, "memory_free_mb": 420, "memory_total_mb": 6951, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T08:20:35.059998Z", "process": "ospf", "pid": 4675, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 4675, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:59:35.057355Z", "process": "telemetry", "pid": 952, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "process": "telemetry", "pid": 952, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:51:35.056507Z", "process": "bgp", "pid": 3634, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "process": "bgp", "pid": 3634, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:42:35.055640Z", "memory_used_percent": 88, "memory_free_mb": 434, "memory_total_mb": 7459, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 434, "memory_total_mb": 7459, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T07:44:35.059118Z", "process": "qfp", "pid": 3482, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "qfp", "pid": 3482, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:09:35.050706Z", "cpu_5s_percent": 97, "cpu_1m_percent": 79, "cpu_5m_percent": 84, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 79, "cpu_5m_percent": 84, "top_process": "SSH Process"}], "cli_fix": ["control-plane", "service-policy input COPP-SYS-DEFAULT", "exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:54:35.059796Z", "process": "qfp", "pid": 454, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "qfp", "pid": 454, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:00:35.051075Z", "cpu_5s_percent": 100, "cpu_1m_percent": 91, "cpu_5m_percent": 77, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 91, "cpu_5m_percent": 77, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:15:35.055009Z", "memory_used_percent": 89, "memory_free_mb": 265, "memory_total_mb": 7480, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 265, "memory_total_mb": 7480, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:32:35.050353Z", "cpu_5s_percent": 95, "cpu_1m_percent": 87, "cpu_5m_percent": 84, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 87, "cpu_5m_percent": 84, "top_process": "SSH Process"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:27:35.051045Z", "cpu_5s_percent": 99, "cpu_1m_percent": 76, "cpu_5m_percent": 69, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 76, "cpu_5m_percent": 69, "top_process": "QoS Stats"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:03:35.049734Z", "cpu_5s_percent": 92, "cpu_1m_percent": 95, "cpu_5m_percent": 69, "top_process": "Hulc LED Process", "description": "CPU utilization exceeded threshold. Top consumer: Hulc LED Process."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 95, "cpu_5m_percent": 69, "top_process": "Hulc LED Process"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:02:35.050433Z", "cpu_5s_percent": 85, "cpu_1m_percent": 94, "cpu_5m_percent": 94, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "cpu_5s_percent": 85, "cpu_1m_percent": 94, "cpu_5m_percent": 94, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:17:35.052816Z", "memory_used_percent": 91, "memory_free_mb": 108, "memory_total_mb": 5643, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 108, "memory_total_mb": 5643, "top_consumer": "http"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:58:35.053665Z", "memory_used_percent": 87, "memory_free_mb": 263, "memory_total_mb": 6924, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 263, "memory_total_mb": 6924, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:53:35.054823Z", "memory_used_percent": 84, "memory_free_mb": 449, "memory_total_mb": 7997, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 449, "memory_total_mb": 7997, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T08:25:35.058768Z", "process": "netconf", "pid": 831, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "process": "netconf", "pid": 831, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:52:35.053260Z", "memory_used_percent": 86, "memory_free_mb": 466, "memory_total_mb": 2719, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 466, "memory_total_mb": 2719, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:32:35.051706Z", "cpu_5s_percent": 85, "cpu_1m_percent": 87, "cpu_5m_percent": 73, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "cpu_5s_percent": 85, "cpu_1m_percent": 87, "cpu_5m_percent": 73, "top_process": "Crypto IKEv2"}], "cli_fix": ["ip cef", "no ip http server", "no ip http secure-server"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:15:35.055201Z", "memory_used_percent": 81, "memory_free_mb": 354, "memory_total_mb": 1416, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "memory_used_percent": 81, "memory_free_mb": 354, "memory_total_mb": 1416, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:03:35.050172Z", "cpu_5s_percent": 97, "cpu_1m_percent": 92, "cpu_5m_percent": 76, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 97, "cpu_1m_percent": 92, "cpu_5m_percent": 76, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "no snmp-server system-shutdown"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T09:47:35.048157Z", "cpu_5s_percent": 100, "cpu_1m_percent": 77, "cpu_5m_percent": 89, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 77, "cpu_5m_percent": 89, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:34:35.050242Z", "cpu_5s_percent": 91, "cpu_1m_percent": 89, "cpu_5m_percent": 79, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 89, "cpu_5m_percent": 79, "top_process": "ARP Input"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:09:35.059655Z", "process": "rp", "pid": 1257, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "rp", "pid": 1257, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:50:35.052960Z", "memory_used_percent": 94, "memory_free_mb": 213, "memory_total_mb": 1574, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "memory_used_percent": 94, "memory_free_mb": 213, "memory_total_mb": 1574, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T09:40:35.055865Z", "memory_used_percent": 90, "memory_free_mb": 69, "memory_total_mb": 1740, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "memory_used_percent": 90, "memory_free_mb": 69, "memory_total_mb": 1740, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T00:57:35.055391Z", "memory_used_percent": 96, "memory_free_mb": 442, "memory_total_mb": 7115, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 442, "memory_total_mb": 7115, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:59:35.049674Z", "cpu_5s_percent": 89, "cpu_1m_percent": 79, "cpu_5m_percent": 90, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "cpu_5s_percent": 89, "cpu_1m_percent": 79, "cpu_5m_percent": 90, "top_process": "IP Input"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:07:35.053134Z", "memory_used_percent": 97, "memory_free_mb": 405, "memory_total_mb": 6309, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 405, "memory_total_mb": 6309, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T01:37:35.057328Z", "process": "iosd", "pid": 4455, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "process": "iosd", "pid": 4455, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", " logging enable", " hidekeys", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T00:45:35.057453Z", "process": "ospf", "pid": 4976, "crash_count_24h": 22, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "process": "ospf", "pid": 4976, "crash_count_24h": 22, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:29:35.060826Z", "process": "netconf", "pid": 641, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "process": "netconf", "pid": 641, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T05:00:35.051595Z", "cpu_5s_percent": 97, "cpu_1m_percent": 88, "cpu_5m_percent": 81, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 88, "cpu_5m_percent": 81, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T04:06:35.052241Z", "memory_used_percent": 87, "memory_free_mb": 332, "memory_total_mb": 3658, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 332, "memory_total_mb": 3658, "top_consumer": "crypto"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T06:28:35.059211Z", "process": "ospf", "pid": 2191, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 2191, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:02:35.057288Z", "process": "bgp", "pid": 3101, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 3101, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T05:32:35.060060Z", "process": "ospf", "pid": 3252, "crash_count_24h": 24, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "process": "ospf", "pid": 3252, "crash_count_24h": 24, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T07:37:35.059704Z", "process": "rp", "pid": 4385, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception", "description": "Process 'rp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "rp", "pid": 4385, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["redundancy", " mode sso", " exit"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T10:03:35.052532Z", "memory_used_percent": 87, "memory_free_mb": 203, "memory_total_mb": 6627, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "memory_used_percent": 87, "memory_free_mb": 203, "memory_total_mb": 6627, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip http client source-interface"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T01:03:35.060856Z", "process": "qfp", "pid": 445, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'qfp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "process": "qfp", "pid": 445, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["platform qfp utilization monitor load 80", "platform qfp utilization monitor interval 300"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T02:03:35.052649Z", "memory_used_percent": 84, "memory_free_mb": 454, "memory_total_mb": 6670, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "memory_used_percent": 84, "memory_free_mb": 454, "memory_total_mb": 6670, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000"]} {"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T06:47:35.055483Z", "memory_used_percent": 94, "memory_free_mb": 224, "memory_total_mb": 4000, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 224, "memory_total_mb": 4000, "top_consumer": "bgp"}], "cli_fix": ["no ip bootp server", "no service config", "no service finger"]} {"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:31:35.050484Z", "cpu_5s_percent": 100, "cpu_1m_percent": 94, "cpu_5m_percent": 79, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 94, "cpu_5m_percent": 79, "top_process": "CEF RP"}], "cli_fix": ["class-map match-any COPP-SYS-SSH", " match protocol ssh", "policy-map COPP-SYS-DEFAULT", " class COPP-SYS-SSH", " police 64000 8000 exceed-action drop", "control-plane", " service-policy input COPP-SYS-DEFAULT"]} {"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T03:32:35.058276Z", "process": "snmpd", "pid": 3873, "crash_count_24h": 19, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3873, "crash_count_24h": 19, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}