{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:47:45.824618Z", "memory_used_percent": 89, "memory_free_mb": 152, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 152, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:01:45.822773Z", "cpu_5s_percent": 86, "cpu_1m_percent": 87, "cpu_5m_percent": 93, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 87, "cpu_5m_percent": 93, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:32:45.829561Z", "process": "iosd", "pid": 4480, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "iosd", "pid": 4480, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:57:45.823600Z", "cpu_5s_percent": 91, "cpu_1m_percent": 91, "cpu_5m_percent": 91, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 91, "cpu_5m_percent": 91, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:09:45.823197Z", "cpu_5s_percent": 85, "cpu_1m_percent": 80, "cpu_5m_percent": 65, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 80, "cpu_5m_percent": 65, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:24:45.824359Z", "memory_used_percent": 82, "memory_free_mb": 344, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 344, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:50:45.822649Z", "cpu_5s_percent": 85, "cpu_1m_percent": 75, "cpu_5m_percent": 69, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 75, "cpu_5m_percent": 69, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:52:45.828721Z", "process": "crypto", "pid": 295, "crash_count_24h": 12, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "crypto", "pid": 295, "crash_count_24h": 12, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:37:45.823168Z", "cpu_5s_percent": 94, "cpu_1m_percent": 76, "cpu_5m_percent": 90, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 76, "cpu_5m_percent": 90, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:13:45.826957Z", "process": "snmpd", "pid": 3564, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3564, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:09:45.824418Z", "memory_used_percent": 90, "memory_free_mb": 457, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 457, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:28:45.824131Z", "memory_used_percent": 86, "memory_free_mb": 120, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 120, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:13:45.828821Z", "process": "snmpd", "pid": 300, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 300, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:18:45.822667Z", "cpu_5s_percent": 87, "cpu_1m_percent": 90, "cpu_5m_percent": 78, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 90, "cpu_5m_percent": 78, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:24:45.825186Z", "memory_used_percent": 85, "memory_free_mb": 133, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 133, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:50:45.823917Z", "cpu_5s_percent": 100, "cpu_1m_percent": 86, "cpu_5m_percent": 85, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 86, "cpu_5m_percent": 85, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:00:45.822027Z", "cpu_5s_percent": 94, "cpu_1m_percent": 78, "cpu_5m_percent": 87, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 78, "cpu_5m_percent": 87, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:54:45.828573Z", "process": "netconf", "pid": 2090, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2090, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:49:45.826394Z", "memory_used_percent": 96, "memory_free_mb": 437, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 437, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:08:45.828323Z", "process": "ospf", "pid": 4307, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "ospf", "pid": 4307, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:24:45.824489Z", "memory_used_percent": 96, "memory_free_mb": 76, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 76, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:15:45.822764Z", "cpu_5s_percent": 94, "cpu_1m_percent": 95, "cpu_5m_percent": 67, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 95, "cpu_5m_percent": 67, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:19:45.829510Z", "process": "telemetry", "pid": 3046, "crash_count_24h": 10, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "telemetry", "pid": 3046, "crash_count_24h": 10, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:41:45.823328Z", "cpu_5s_percent": 89, "cpu_1m_percent": 84, "cpu_5m_percent": 94, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 84, "cpu_5m_percent": 94, "top_process": "IP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:46:45.824624Z", "memory_used_percent": 93, "memory_free_mb": 178, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 178, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T21:16:45.826163Z", "memory_used_percent": 94, "memory_free_mb": 147, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 147, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:48:45.827512Z", "process": "bgp", "pid": 3471, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "bgp", "pid": 3471, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:37:45.826058Z", "memory_used_percent": 80, "memory_free_mb": 244, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 244, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:44:45.822301Z", "cpu_5s_percent": 90, "cpu_1m_percent": 76, "cpu_5m_percent": 82, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 76, "cpu_5m_percent": 82, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:10:45.825356Z", "memory_used_percent": 88, "memory_free_mb": 118, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 118, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:32:45.827633Z", "process": "bgp", "pid": 3903, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 3903, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:13:45.828479Z", "process": "telemetry", "pid": 2518, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "telemetry", "pid": 2518, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T11:35:45.826002Z", "memory_used_percent": 91, "memory_free_mb": 54, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 54, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:50:45.827850Z", "process": "telemetry", "pid": 2596, "crash_count_24h": 7, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 2596, "crash_count_24h": 7, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:20:45.822132Z", "cpu_5s_percent": 87, "cpu_1m_percent": 81, "cpu_5m_percent": 90, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 81, "cpu_5m_percent": 90, "top_process": "CEF RP"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:11:45.824962Z", "memory_used_percent": 99, "memory_free_mb": 482, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 482, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:22:45.827836Z", "process": "snmpd", "pid": 4310, "crash_count_24h": 14, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4310, "crash_count_24h": 14, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:20:45.828639Z", "process": "ospf", "pid": 4840, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 4840, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:05:45.822143Z", "cpu_5s_percent": 88, "cpu_1m_percent": 84, "cpu_5m_percent": 82, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 84, "cpu_5m_percent": 82, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:05:45.825854Z", "memory_used_percent": 95, "memory_free_mb": 77, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 77, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T11:55:45.827844Z", "process": "ospf", "pid": 2555, "crash_count_24h": 14, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 2555, "crash_count_24h": 14, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:29:45.822680Z", "cpu_5s_percent": 88, "cpu_1m_percent": 92, "cpu_5m_percent": 68, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 92, "cpu_5m_percent": 68, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T21:19:45.826218Z", "memory_used_percent": 98, "memory_free_mb": 337, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 337, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:08:45.829620Z", "process": "telemetry", "pid": 4245, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 4245, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:42:45.828856Z", "process": "ospf", "pid": 3113, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3113, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:27:45.825193Z", "memory_used_percent": 84, "memory_free_mb": 408, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 408, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:29:45.823463Z", "cpu_5s_percent": 100, "cpu_1m_percent": 89, "cpu_5m_percent": 86, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 89, "cpu_5m_percent": 86, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:23:45.826633Z", "memory_used_percent": 97, "memory_free_mb": 73, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 73, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:17:45.824174Z", "memory_used_percent": 81, "memory_free_mb": 403, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 403, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:45:45.827927Z", "process": "telemetry", "pid": 330, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 330, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:45:45.823049Z", "cpu_5s_percent": 89, "cpu_1m_percent": 81, "cpu_5m_percent": 89, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 81, "cpu_5m_percent": 89, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:17:45.825690Z", "memory_used_percent": 86, "memory_free_mb": 368, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 368, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:27:45.828224Z", "process": "iosd", "pid": 2421, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 2421, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:49:45.822606Z", "cpu_5s_percent": 98, "cpu_1m_percent": 91, "cpu_5m_percent": 65, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 91, "cpu_5m_percent": 65, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:14:45.825240Z", "memory_used_percent": 91, "memory_free_mb": 339, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 339, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:35:45.829769Z", "process": "bgp", "pid": 1511, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 1511, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:09:45.828909Z", "process": "netconf", "pid": 3923, "crash_count_24h": 3, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 3923, "crash_count_24h": 3, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:06:45.824990Z", "memory_used_percent": 94, "memory_free_mb": 242, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 242, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:51:45.826820Z", "process": "ospf", "pid": 2961, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 2961, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:36:45.825083Z", "memory_used_percent": 82, "memory_free_mb": 170, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 170, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:50:45.825570Z", "memory_used_percent": 97, "memory_free_mb": 102, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 102, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:44:45.823839Z", "cpu_5s_percent": 91, "cpu_1m_percent": 94, "cpu_5m_percent": 78, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 94, "cpu_5m_percent": 78, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:25:45.825985Z", "memory_used_percent": 86, "memory_free_mb": 383, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 383, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:21:45.826610Z", "memory_used_percent": 81, "memory_free_mb": 444, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 444, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:38:45.823929Z", "cpu_5s_percent": 87, "cpu_1m_percent": 75, "cpu_5m_percent": 71, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 75, "cpu_5m_percent": 71, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:14:45.823879Z", "cpu_5s_percent": 94, "cpu_1m_percent": 88, "cpu_5m_percent": 65, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 88, "cpu_5m_percent": 65, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:26:45.823706Z", "cpu_5s_percent": 95, "cpu_1m_percent": 95, "cpu_5m_percent": 77, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 95, "cpu_5m_percent": 77, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:11:45.828880Z", "process": "bgp", "pid": 3104, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 3104, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:20:45.824496Z", "memory_used_percent": 99, "memory_free_mb": 143, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 143, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:42:45.825403Z", "memory_used_percent": 95, "memory_free_mb": 167, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 167, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:02:45.823535Z", "cpu_5s_percent": 87, "cpu_1m_percent": 75, "cpu_5m_percent": 75, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 75, "cpu_5m_percent": 75, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:27:45.824209Z", "memory_used_percent": 87, "memory_free_mb": 249, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 249, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:00:45.823553Z", "cpu_5s_percent": 92, "cpu_1m_percent": 77, "cpu_5m_percent": 86, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 77, "cpu_5m_percent": 86, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:10:45.823747Z", "cpu_5s_percent": 91, "cpu_1m_percent": 88, "cpu_5m_percent": 65, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 88, "cpu_5m_percent": 65, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:20:45.828252Z", "process": "bgp", "pid": 176, "crash_count_24h": 15, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "bgp", "pid": 176, "crash_count_24h": 15, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:24:45.828715Z", "process": "crypto", "pid": 4178, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 4178, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T21:09:45.826096Z", "memory_used_percent": 93, "memory_free_mb": 233, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 233, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:10:45.822828Z", "cpu_5s_percent": 92, "cpu_1m_percent": 76, "cpu_5m_percent": 67, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 76, "cpu_5m_percent": 67, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:08:45.829747Z", "process": "crypto", "pid": 2185, "crash_count_24h": 10, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 2185, "crash_count_24h": 10, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:11:45.821921Z", "cpu_5s_percent": 94, "cpu_1m_percent": 95, "cpu_5m_percent": 86, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 95, "cpu_5m_percent": 86, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T11:54:45.823571Z", "cpu_5s_percent": 88, "cpu_1m_percent": 90, "cpu_5m_percent": 84, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 90, "cpu_5m_percent": 84, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:19:45.827395Z", "process": "telemetry", "pid": 2428, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 2428, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:51:45.825258Z", "memory_used_percent": 89, "memory_free_mb": 208, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 208, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:15:45.825385Z", "memory_used_percent": 80, "memory_free_mb": 124, "memory_total_mb": 1024, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 124, "memory_total_mb": 1024, "top_consumer": "ospf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:26:45.823810Z", "cpu_5s_percent": 90, "cpu_1m_percent": 96, "cpu_5m_percent": 87, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 96, "cpu_5m_percent": 87, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:17:45.826444Z", "memory_used_percent": 87, "memory_free_mb": 82, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 82, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:09:45.827783Z", "process": "crypto", "pid": 1499, "crash_count_24h": 14, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1499, "crash_count_24h": 14, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:35:45.827096Z", "process": "telemetry", "pid": 3220, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "telemetry", "pid": 3220, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:58:45.822076Z", "cpu_5s_percent": 89, "cpu_1m_percent": 81, "cpu_5m_percent": 86, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 81, "cpu_5m_percent": 86, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T21:18:45.828337Z", "process": "snmpd", "pid": 1071, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "snmpd", "pid": 1071, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:08:45.824566Z", "memory_used_percent": 93, "memory_free_mb": 401, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 401, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:05:45.823114Z", "cpu_5s_percent": 95, "cpu_1m_percent": 97, "cpu_5m_percent": 83, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 97, "cpu_5m_percent": 83, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:27:45.824846Z", "memory_used_percent": 92, "memory_free_mb": 489, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 489, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T21:18:45.822436Z", "cpu_5s_percent": 92, "cpu_1m_percent": 93, "cpu_5m_percent": 88, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 93, "cpu_5m_percent": 88, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:58:45.822499Z", "cpu_5s_percent": 97, "cpu_1m_percent": 78, "cpu_5m_percent": 84, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 78, "cpu_5m_percent": 84, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:20:45.825010Z", "memory_used_percent": 80, "memory_free_mb": 395, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 395, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:10:45.821968Z", "cpu_5s_percent": 87, "cpu_1m_percent": 77, "cpu_5m_percent": 92, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 77, "cpu_5m_percent": 92, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:23:45.828600Z", "process": "snmpd", "pid": 1267, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 1267, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T11:38:45.821662Z", "cpu_5s_percent": 87, "cpu_1m_percent": 95, "cpu_5m_percent": 81, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 95, "cpu_5m_percent": 81, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:02:45.826049Z", "memory_used_percent": 84, "memory_free_mb": 362, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 362, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:52:45.824387Z", "memory_used_percent": 99, "memory_free_mb": 347, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 347, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:20:45.823323Z", "cpu_5s_percent": 93, "cpu_1m_percent": 95, "cpu_5m_percent": 87, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 95, "cpu_5m_percent": 87, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T21:18:45.825863Z", "memory_used_percent": 94, "memory_free_mb": 420, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 420, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:09:45.825485Z", "memory_used_percent": 96, "memory_free_mb": 112, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 112, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:19:45.822021Z", "cpu_5s_percent": 87, "cpu_1m_percent": 82, "cpu_5m_percent": 81, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 82, "cpu_5m_percent": 81, "top_process": "SSH Process"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:13:45.827899Z", "process": "bgp", "pid": 1951, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 1951, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:02:45.822468Z", "cpu_5s_percent": 88, "cpu_1m_percent": 76, "cpu_5m_percent": 66, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 76, "cpu_5m_percent": 66, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:13:45.823430Z", "cpu_5s_percent": 91, "cpu_1m_percent": 94, "cpu_5m_percent": 82, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 94, "cpu_5m_percent": 82, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:04:45.829400Z", "process": "iosd", "pid": 1818, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 1818, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:54:45.824853Z", "memory_used_percent": 94, "memory_free_mb": 377, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 377, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:08:45.827575Z", "process": "ospf", "pid": 4854, "crash_count_24h": 19, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "ospf", "pid": 4854, "crash_count_24h": 19, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:29:45.824837Z", "memory_used_percent": 90, "memory_free_mb": 455, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 455, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:40:45.828444Z", "process": "netconf", "pid": 4464, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "netconf", "pid": 4464, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:15:45.826409Z", "memory_used_percent": 87, "memory_free_mb": 228, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 228, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:20:45.826591Z", "memory_used_percent": 83, "memory_free_mb": 270, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 270, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:49:45.824590Z", "memory_used_percent": 92, "memory_free_mb": 381, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 381, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:28:45.824998Z", "memory_used_percent": 83, "memory_free_mb": 292, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 292, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:26:45.829311Z", "process": "telemetry", "pid": 360, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "telemetry", "pid": 360, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:45:45.822821Z", "cpu_5s_percent": 86, "cpu_1m_percent": 80, "cpu_5m_percent": 88, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 80, "cpu_5m_percent": 88, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:45:45.829411Z", "process": "netconf", "pid": 1344, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "netconf", "pid": 1344, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:21:45.821842Z", "cpu_5s_percent": 99, "cpu_1m_percent": 78, "cpu_5m_percent": 86, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 78, "cpu_5m_percent": 86, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:28:45.823986Z", "cpu_5s_percent": 90, "cpu_1m_percent": 81, "cpu_5m_percent": 76, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 81, "cpu_5m_percent": 76, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:53:45.823394Z", "cpu_5s_percent": 86, "cpu_1m_percent": 90, "cpu_5m_percent": 84, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 90, "cpu_5m_percent": 84, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:50:45.824251Z", "memory_used_percent": 80, "memory_free_mb": 283, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 283, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:29:45.825599Z", "memory_used_percent": 98, "memory_free_mb": 260, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 260, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:56:45.828620Z", "process": "crypto", "pid": 859, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "crypto", "pid": 859, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:25:45.823286Z", "cpu_5s_percent": 88, "cpu_1m_percent": 77, "cpu_5m_percent": 90, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 77, "cpu_5m_percent": 90, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:16:45.822314Z", "cpu_5s_percent": 92, "cpu_1m_percent": 89, "cpu_5m_percent": 89, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 89, "cpu_5m_percent": 89, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:39:45.827520Z", "process": "netconf", "pid": 1345, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "netconf", "pid": 1345, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:22:45.827756Z", "process": "iosd", "pid": 1098, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 1098, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:28:45.824883Z", "memory_used_percent": 89, "memory_free_mb": 440, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 440, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:44:45.823370Z", "cpu_5s_percent": 99, "cpu_1m_percent": 99, "cpu_5m_percent": 68, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 99, "cpu_5m_percent": 68, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:15:45.827996Z", "process": "netconf", "pid": 4346, "crash_count_24h": 25, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4346, "crash_count_24h": 25, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:50:45.825836Z", "memory_used_percent": 80, "memory_free_mb": 439, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 439, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:34:45.825016Z", "memory_used_percent": 89, "memory_free_mb": 66, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 66, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:55:45.823441Z", "cpu_5s_percent": 89, "cpu_1m_percent": 84, "cpu_5m_percent": 73, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 84, "cpu_5m_percent": 73, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:33:45.822109Z", "cpu_5s_percent": 86, "cpu_1m_percent": 96, "cpu_5m_percent": 65, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 96, "cpu_5m_percent": 65, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:45:45.826650Z", "memory_used_percent": 81, "memory_free_mb": 299, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 299, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:13:45.822511Z", "cpu_5s_percent": 89, "cpu_1m_percent": 91, "cpu_5m_percent": 74, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 91, "cpu_5m_percent": 74, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:59:45.827549Z", "process": "crypto", "pid": 4948, "crash_count_24h": 4, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 4948, "crash_count_24h": 4, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:00:45.823968Z", "cpu_5s_percent": 95, "cpu_1m_percent": 79, "cpu_5m_percent": 75, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 79, "cpu_5m_percent": 75, "top_process": "SSH Process"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:11:45.823191Z", "cpu_5s_percent": 94, "cpu_1m_percent": 81, "cpu_5m_percent": 84, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 81, "cpu_5m_percent": 84, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:52:45.827688Z", "process": "ospf", "pid": 3110, "crash_count_24h": 25, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3110, "crash_count_24h": 25, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:07:45.824606Z", "memory_used_percent": 83, "memory_free_mb": 322, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 322, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:39:45.827320Z", "process": "crypto", "pid": 1163, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 1163, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T21:29:45.829491Z", "process": "crypto", "pid": 1688, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 1688, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:30:45.828433Z", "process": "netconf", "pid": 4232, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "netconf", "pid": 4232, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:13:45.824739Z", "memory_used_percent": 88, "memory_free_mb": 193, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 193, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:10:45.825317Z", "memory_used_percent": 85, "memory_free_mb": 116, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 116, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:49:45.823934Z", "cpu_5s_percent": 95, "cpu_1m_percent": 81, "cpu_5m_percent": 66, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 81, "cpu_5m_percent": 66, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:33:45.825004Z", "memory_used_percent": 82, "memory_free_mb": 281, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 281, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:38:45.821817Z", "cpu_5s_percent": 97, "cpu_1m_percent": 97, "cpu_5m_percent": 67, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 97, "cpu_5m_percent": 67, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:29:45.827627Z", "process": "snmpd", "pid": 1805, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 1805, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:40:45.823361Z", "cpu_5s_percent": 87, "cpu_1m_percent": 94, "cpu_5m_percent": 93, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 94, "cpu_5m_percent": 93, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:19:45.823993Z", "cpu_5s_percent": 100, "cpu_1m_percent": 94, "cpu_5m_percent": 65, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 94, "cpu_5m_percent": 65, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:31:45.822662Z", "cpu_5s_percent": 90, "cpu_1m_percent": 83, "cpu_5m_percent": 65, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 83, "cpu_5m_percent": 65, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:14:45.827715Z", "process": "crypto", "pid": 3308, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "crypto", "pid": 3308, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:42:45.822122Z", "cpu_5s_percent": 91, "cpu_1m_percent": 96, "cpu_5m_percent": 67, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 96, "cpu_5m_percent": 67, "top_process": "Crypto IKEv2"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:57:45.826255Z", "memory_used_percent": 89, "memory_free_mb": 401, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 401, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:04:45.823518Z", "cpu_5s_percent": 99, "cpu_1m_percent": 93, "cpu_5m_percent": 77, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 93, "cpu_5m_percent": 77, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:48:45.828866Z", "process": "crypto", "pid": 3669, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 3669, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:26:45.826557Z", "memory_used_percent": 80, "memory_free_mb": 430, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 430, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:13:45.829458Z", "process": "crypto", "pid": 138, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 138, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:59:45.825976Z", "memory_used_percent": 95, "memory_free_mb": 310, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 310, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:06:45.822928Z", "cpu_5s_percent": 94, "cpu_1m_percent": 79, "cpu_5m_percent": 72, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 79, "cpu_5m_percent": 72, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:10:45.826105Z", "memory_used_percent": 94, "memory_free_mb": 481, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 481, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T21:06:45.827816Z", "process": "netconf", "pid": 2182, "crash_count_24h": 20, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2182, "crash_count_24h": 20, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:45:45.827458Z", "process": "crypto", "pid": 4296, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "crypto", "pid": 4296, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:41:45.824479Z", "memory_used_percent": 95, "memory_free_mb": 291, "memory_total_mb": 4096, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 291, "memory_total_mb": 4096, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:49:45.825634Z", "memory_used_percent": 99, "memory_free_mb": 382, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 382, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:59:45.824310Z", "memory_used_percent": 94, "memory_free_mb": 484, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 484, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:41:45.822505Z", "cpu_5s_percent": 95, "cpu_1m_percent": 90, "cpu_5m_percent": 92, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 90, "cpu_5m_percent": 92, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:09:45.825436Z", "memory_used_percent": 89, "memory_free_mb": 348, "memory_total_mb": 1024, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 348, "memory_total_mb": 1024, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T21:08:45.826517Z", "memory_used_percent": 81, "memory_free_mb": 456, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 456, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:49:45.826115Z", "memory_used_percent": 88, "memory_free_mb": 130, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 130, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T21:01:45.829417Z", "process": "bgp", "pid": 1379, "crash_count_24h": 6, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "bgp", "pid": 1379, "crash_count_24h": 6, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:18:45.829591Z", "process": "ospf", "pid": 144, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 144, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:06:45.822791Z", "cpu_5s_percent": 91, "cpu_1m_percent": 89, "cpu_5m_percent": 82, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 89, "cpu_5m_percent": 82, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:54:45.828458Z", "process": "snmpd", "pid": 4010, "crash_count_24h": 3, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4010, "crash_count_24h": 3, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:53:45.824426Z", "memory_used_percent": 84, "memory_free_mb": 85, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 85, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:06:45.828488Z", "process": "ospf", "pid": 801, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 801, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:01:45.824372Z", "memory_used_percent": 98, "memory_free_mb": 220, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 220, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:21:45.825426Z", "memory_used_percent": 91, "memory_free_mb": 298, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 298, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:04:45.824656Z", "memory_used_percent": 93, "memory_free_mb": 433, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 433, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:38:45.822922Z", "cpu_5s_percent": 100, "cpu_1m_percent": 76, "cpu_5m_percent": 76, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 76, "cpu_5m_percent": 76, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:46:45.827364Z", "process": "snmpd", "pid": 4388, "crash_count_24h": 14, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "snmpd", "pid": 4388, "crash_count_24h": 14, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:01:45.827964Z", "process": "crypto", "pid": 1279, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 1279, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:54:45.828848Z", "process": "bgp", "pid": 3481, "crash_count_24h": 12, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 3481, "crash_count_24h": 12, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:42:45.823304Z", "cpu_5s_percent": 96, "cpu_1m_percent": 77, "cpu_5m_percent": 80, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 77, "cpu_5m_percent": 80, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:03:45.826475Z", "memory_used_percent": 88, "memory_free_mb": 83, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 83, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:28:45.829666Z", "process": "telemetry", "pid": 2926, "crash_count_24h": 10, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 2926, "crash_count_24h": 10, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:58:45.822356Z", "cpu_5s_percent": 92, "cpu_1m_percent": 91, "cpu_5m_percent": 84, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 91, "cpu_5m_percent": 84, "top_process": "IP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:48:45.824242Z", "memory_used_percent": 92, "memory_free_mb": 252, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 252, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:02:45.828727Z", "process": "netconf", "pid": 1332, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 1332, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:57:45.828373Z", "process": "crypto", "pid": 1084, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1084, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:29:45.827774Z", "process": "netconf", "pid": 866, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 866, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:22:45.822629Z", "cpu_5s_percent": 88, "cpu_1m_percent": 94, "cpu_5m_percent": 71, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 94, "cpu_5m_percent": 71, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:43:45.822601Z", "cpu_5s_percent": 95, "cpu_1m_percent": 84, "cpu_5m_percent": 86, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 84, "cpu_5m_percent": 86, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:22:45.823162Z", "cpu_5s_percent": 99, "cpu_1m_percent": 92, "cpu_5m_percent": 73, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 92, "cpu_5m_percent": 73, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:00:45.824695Z", "memory_used_percent": 84, "memory_free_mb": 135, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 135, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:33:45.828285Z", "process": "telemetry", "pid": 1690, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 1690, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:31:45.823830Z", "cpu_5s_percent": 98, "cpu_1m_percent": 83, "cpu_5m_percent": 95, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 83, "cpu_5m_percent": 95, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:31:45.826627Z", "memory_used_percent": 84, "memory_free_mb": 102, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 102, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:26:45.824109Z", "memory_used_percent": 93, "memory_free_mb": 374, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 374, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:43:45.829012Z", "process": "iosd", "pid": 3371, "crash_count_24h": 3, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "iosd", "pid": 3371, "crash_count_24h": 3, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:24:45.823239Z", "cpu_5s_percent": 100, "cpu_1m_percent": 92, "cpu_5m_percent": 93, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 92, "cpu_5m_percent": 93, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:42:45.827415Z", "process": "netconf", "pid": 3418, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 3418, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:25:45.825132Z", "memory_used_percent": 99, "memory_free_mb": 93, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 93, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:01:45.826616Z", "memory_used_percent": 93, "memory_free_mb": 209, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 209, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:08:45.821669Z", "cpu_5s_percent": 86, "cpu_1m_percent": 96, "cpu_5m_percent": 65, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 96, "cpu_5m_percent": 65, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:13:45.825028Z", "memory_used_percent": 83, "memory_free_mb": 270, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 270, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:23:45.824299Z", "memory_used_percent": 94, "memory_free_mb": 374, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 374, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:04:45.824182Z", "memory_used_percent": 89, "memory_free_mb": 188, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 188, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:12:45.824343Z", "memory_used_percent": 93, "memory_free_mb": 239, "memory_total_mb": 1024, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 239, "memory_total_mb": 1024, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:52:45.822259Z", "cpu_5s_percent": 87, "cpu_1m_percent": 87, "cpu_5m_percent": 88, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 87, "cpu_5m_percent": 88, "top_process": "Crypto IKEv2"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:54:45.823671Z", "cpu_5s_percent": 94, "cpu_1m_percent": 79, "cpu_5m_percent": 92, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 79, "cpu_5m_percent": 92, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:13:45.828290Z", "process": "iosd", "pid": 4672, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "iosd", "pid": 4672, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:05:45.824472Z", "memory_used_percent": 82, "memory_free_mb": 182, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 182, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:23:45.827440Z", "process": "iosd", "pid": 3584, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "iosd", "pid": 3584, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:39:45.822755Z", "cpu_5s_percent": 100, "cpu_1m_percent": 75, "cpu_5m_percent": 84, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 75, "cpu_5m_percent": 84, "top_process": "Net Background"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:52:45.823102Z", "cpu_5s_percent": 91, "cpu_1m_percent": 97, "cpu_5m_percent": 88, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 97, "cpu_5m_percent": 88, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:52:45.825413Z", "memory_used_percent": 92, "memory_free_mb": 291, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 291, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:35:45.823647Z", "cpu_5s_percent": 94, "cpu_1m_percent": 95, "cpu_5m_percent": 68, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 95, "cpu_5m_percent": 68, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:37:45.823860Z", "cpu_5s_percent": 86, "cpu_1m_percent": 92, "cpu_5m_percent": 91, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 92, "cpu_5m_percent": 91, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:30:45.822690Z", "cpu_5s_percent": 86, "cpu_1m_percent": 81, "cpu_5m_percent": 72, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 81, "cpu_5m_percent": 72, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:25:45.823015Z", "cpu_5s_percent": 96, "cpu_1m_percent": 75, "cpu_5m_percent": 73, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 75, "cpu_5m_percent": 73, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:54:45.822897Z", "cpu_5s_percent": 93, "cpu_1m_percent": 75, "cpu_5m_percent": 84, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 75, "cpu_5m_percent": 84, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:46:45.826968Z", "process": "snmpd", "pid": 3294, "crash_count_24h": 20, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3294, "crash_count_24h": 20, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:38:45.824412Z", "memory_used_percent": 92, "memory_free_mb": 391, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 391, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:28:45.826481Z", "memory_used_percent": 92, "memory_free_mb": 380, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 380, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:11:45.821648Z", "cpu_5s_percent": 96, "cpu_1m_percent": 87, "cpu_5m_percent": 77, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 87, "cpu_5m_percent": 77, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:51:45.828010Z", "process": "iosd", "pid": 3095, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "iosd", "pid": 3095, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:19:45.826996Z", "process": "bgp", "pid": 1944, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "bgp", "pid": 1944, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:09:45.823899Z", "cpu_5s_percent": 86, "cpu_1m_percent": 99, "cpu_5m_percent": 87, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 99, "cpu_5m_percent": 87, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:49:45.826563Z", "memory_used_percent": 86, "memory_free_mb": 398, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 398, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:46:45.823547Z", "cpu_5s_percent": 99, "cpu_1m_percent": 97, "cpu_5m_percent": 89, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 97, "cpu_5m_percent": 89, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:52:45.826322Z", "memory_used_percent": 93, "memory_free_mb": 126, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 126, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:59:45.828808Z", "process": "bgp", "pid": 1723, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "bgp", "pid": 1723, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T21:24:45.828526Z", "process": "snmpd", "pid": 3054, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3054, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T21:01:45.822989Z", "cpu_5s_percent": 96, "cpu_1m_percent": 80, "cpu_5m_percent": 71, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 80, "cpu_5m_percent": 71, "top_process": "SNMP ENGINE"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:22:45.823980Z", "cpu_5s_percent": 96, "cpu_1m_percent": 97, "cpu_5m_percent": 80, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 97, "cpu_5m_percent": 80, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:20:45.825846Z", "memory_used_percent": 92, "memory_free_mb": 199, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 199, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:37:45.823758Z", "cpu_5s_percent": 93, "cpu_1m_percent": 75, "cpu_5m_percent": 85, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 75, "cpu_5m_percent": 85, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:52:45.828087Z", "process": "telemetry", "pid": 3273, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 3273, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:38:45.822486Z", "cpu_5s_percent": 93, "cpu_1m_percent": 99, "cpu_5m_percent": 67, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 99, "cpu_5m_percent": 67, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:46:45.823310Z", "cpu_5s_percent": 99, "cpu_1m_percent": 76, "cpu_5m_percent": 72, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 76, "cpu_5m_percent": 72, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:58:45.827421Z", "process": "netconf", "pid": 2625, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "netconf", "pid": 2625, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:47:45.822345Z", "cpu_5s_percent": 92, "cpu_1m_percent": 91, "cpu_5m_percent": 80, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 91, "cpu_5m_percent": 80, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:18:45.825616Z", "memory_used_percent": 92, "memory_free_mb": 481, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 481, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:02:45.828689Z", "process": "iosd", "pid": 3910, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3910, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:43:45.829659Z", "process": "ospf", "pid": 3636, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3636, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:50:45.823085Z", "cpu_5s_percent": 93, "cpu_1m_percent": 84, "cpu_5m_percent": 82, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 84, "cpu_5m_percent": 82, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:10:45.825957Z", "memory_used_percent": 95, "memory_free_mb": 73, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 73, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:06:45.826330Z", "memory_used_percent": 87, "memory_free_mb": 401, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 401, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:34:45.822015Z", "cpu_5s_percent": 87, "cpu_1m_percent": 92, "cpu_5m_percent": 85, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 92, "cpu_5m_percent": 85, "top_process": "SNMP ENGINE"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:55:45.824377Z", "memory_used_percent": 89, "memory_free_mb": 425, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 425, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:15:45.825476Z", "memory_used_percent": 85, "memory_free_mb": 405, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 405, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:12:45.826029Z", "memory_used_percent": 97, "memory_free_mb": 160, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 160, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:15:45.827006Z", "process": "telemetry", "pid": 4717, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "telemetry", "pid": 4717, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:01:45.822393Z", "cpu_5s_percent": 98, "cpu_1m_percent": 88, "cpu_5m_percent": 66, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 88, "cpu_5m_percent": 66, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T21:22:45.822879Z", "cpu_5s_percent": 99, "cpu_1m_percent": 76, "cpu_5m_percent": 92, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 76, "cpu_5m_percent": 92, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:01:45.825445Z", "memory_used_percent": 90, "memory_free_mb": 58, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 58, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:16:45.823623Z", "cpu_5s_percent": 98, "cpu_1m_percent": 96, "cpu_5m_percent": 95, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 96, "cpu_5m_percent": 95, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:31:45.827663Z", "process": "iosd", "pid": 4353, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4353, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:30:45.827148Z", "process": "ospf", "pid": 3469, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3469, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:13:45.826855Z", "process": "telemetry", "pid": 1057, "crash_count_24h": 25, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 1057, "crash_count_24h": 25, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:41:45.822325Z", "cpu_5s_percent": 93, "cpu_1m_percent": 99, "cpu_5m_percent": 84, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 99, "cpu_5m_percent": 84, "top_process": "CEF RP"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:01:45.827106Z", "process": "bgp", "pid": 2402, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "bgp", "pid": 2402, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:17:45.824877Z", "memory_used_percent": 89, "memory_free_mb": 234, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 234, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:43:45.823764Z", "cpu_5s_percent": 86, "cpu_1m_percent": 96, "cpu_5m_percent": 93, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 96, "cpu_5m_percent": 93, "top_process": "IP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:19:45.825336Z", "memory_used_percent": 90, "memory_free_mb": 398, "memory_total_mb": 8192, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 398, "memory_total_mb": 8192, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:08:45.822673Z", "cpu_5s_percent": 92, "cpu_1m_percent": 92, "cpu_5m_percent": 75, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 92, "cpu_5m_percent": 75, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:27:45.824352Z", "memory_used_percent": 97, "memory_free_mb": 222, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 222, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:25:45.823400Z", "cpu_5s_percent": 95, "cpu_1m_percent": 89, "cpu_5m_percent": 66, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 89, "cpu_5m_percent": 66, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:59:45.828788Z", "process": "crypto", "pid": 4259, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 4259, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:55:45.828218Z", "process": "telemetry", "pid": 3578, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "telemetry", "pid": 3578, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:31:45.827061Z", "process": "snmpd", "pid": 4180, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4180, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:31:45.827891Z", "process": "ospf", "pid": 4937, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 4937, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:15:45.828239Z", "process": "snmpd", "pid": 3865, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3865, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:52:45.825531Z", "memory_used_percent": 96, "memory_free_mb": 421, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 421, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T11:31:45.822197Z", "cpu_5s_percent": 85, "cpu_1m_percent": 89, "cpu_5m_percent": 67, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 89, "cpu_5m_percent": 67, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:13:45.826688Z", "memory_used_percent": 80, "memory_free_mb": 451, "memory_total_mb": 8192, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 451, "memory_total_mb": 8192, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:18:45.822403Z", "cpu_5s_percent": 88, "cpu_1m_percent": 99, "cpu_5m_percent": 82, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 99, "cpu_5m_percent": 82, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:19:45.822291Z", "cpu_5s_percent": 95, "cpu_1m_percent": 82, "cpu_5m_percent": 74, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 82, "cpu_5m_percent": 74, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:58:45.821901Z", "cpu_5s_percent": 92, "cpu_1m_percent": 95, "cpu_5m_percent": 66, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 95, "cpu_5m_percent": 66, "top_process": "SNMP ENGINE"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:01:45.823816Z", "cpu_5s_percent": 96, "cpu_1m_percent": 87, "cpu_5m_percent": 72, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 87, "cpu_5m_percent": 72, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:18:45.824558Z", "memory_used_percent": 91, "memory_free_mb": 487, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 487, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:54:45.823214Z", "cpu_5s_percent": 98, "cpu_1m_percent": 96, "cpu_5m_percent": 94, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 96, "cpu_5m_percent": 94, "top_process": "CEF RP"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:48:45.826540Z", "memory_used_percent": 98, "memory_free_mb": 406, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 406, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:38:45.822099Z", "cpu_5s_percent": 100, "cpu_1m_percent": 83, "cpu_5m_percent": 69, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 83, "cpu_5m_percent": 69, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:51:45.828258Z", "process": "bgp", "pid": 2847, "crash_count_24h": 10, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 2847, "crash_count_24h": 10, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:23:45.829005Z", "process": "crypto", "pid": 1422, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 1422, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:19:45.827601Z", "process": "iosd", "pid": 3486, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3486, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:28:45.823697Z", "cpu_5s_percent": 98, "cpu_1m_percent": 95, "cpu_5m_percent": 93, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 95, "cpu_5m_percent": 93, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:48:45.824161Z", "memory_used_percent": 94, "memory_free_mb": 271, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 271, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:13:45.822915Z", "cpu_5s_percent": 91, "cpu_1m_percent": 99, "cpu_5m_percent": 89, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 99, "cpu_5m_percent": 89, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:13:45.824865Z", "memory_used_percent": 93, "memory_free_mb": 144, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 144, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:08:45.828093Z", "process": "bgp", "pid": 456, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "bgp", "pid": 456, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T21:21:45.826438Z", "memory_used_percent": 90, "memory_free_mb": 453, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 453, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:43:45.824502Z", "memory_used_percent": 82, "memory_free_mb": 149, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 149, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:41:45.827450Z", "process": "crypto", "pid": 337, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 337, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:12:45.822492Z", "cpu_5s_percent": 98, "cpu_1m_percent": 75, "cpu_5m_percent": 78, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 75, "cpu_5m_percent": 78, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:21:45.828049Z", "process": "iosd", "pid": 911, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "iosd", "pid": 911, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:43:45.822741Z", "cpu_5s_percent": 97, "cpu_1m_percent": 76, "cpu_5m_percent": 72, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 76, "cpu_5m_percent": 72, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:00:45.824722Z", "memory_used_percent": 81, "memory_free_mb": 307, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 307, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:14:45.825150Z", "memory_used_percent": 81, "memory_free_mb": 448, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 448, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:42:45.823633Z", "cpu_5s_percent": 90, "cpu_1m_percent": 91, "cpu_5m_percent": 76, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 91, "cpu_5m_percent": 76, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:04:45.828404Z", "process": "telemetry", "pid": 861, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 861, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:31:45.828311Z", "process": "iosd", "pid": 3544, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "iosd", "pid": 3544, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:46:45.828317Z", "process": "ospf", "pid": 3540, "crash_count_24h": 20, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3540, "crash_count_24h": 20, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:06:45.828425Z", "process": "telemetry", "pid": 3556, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "telemetry", "pid": 3556, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:15:45.823541Z", "cpu_5s_percent": 94, "cpu_1m_percent": 80, "cpu_5m_percent": 66, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 80, "cpu_5m_percent": 66, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:31:45.825579Z", "memory_used_percent": 94, "memory_free_mb": 163, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 163, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:57:45.823424Z", "cpu_5s_percent": 94, "cpu_1m_percent": 94, "cpu_5m_percent": 76, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 94, "cpu_5m_percent": 76, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:14:45.825308Z", "memory_used_percent": 95, "memory_free_mb": 295, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 295, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:48:45.823974Z", "cpu_5s_percent": 98, "cpu_1m_percent": 77, "cpu_5m_percent": 77, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 77, "cpu_5m_percent": 77, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:17:45.823126Z", "cpu_5s_percent": 94, "cpu_1m_percent": 91, "cpu_5m_percent": 67, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 91, "cpu_5m_percent": 67, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:13:45.825346Z", "memory_used_percent": 82, "memory_free_mb": 290, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 290, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T21:19:45.828390Z", "process": "netconf", "pid": 1734, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "netconf", "pid": 1734, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:47:45.826506Z", "memory_used_percent": 96, "memory_free_mb": 416, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 416, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:59:45.822167Z", "cpu_5s_percent": 93, "cpu_1m_percent": 76, "cpu_5m_percent": 93, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 76, "cpu_5m_percent": 93, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:37:45.827431Z", "process": "iosd", "pid": 391, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 391, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:42:45.825065Z", "memory_used_percent": 97, "memory_free_mb": 80, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 80, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:13:45.826676Z", "memory_used_percent": 84, "memory_free_mb": 201, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 201, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:58:45.826281Z", "memory_used_percent": 80, "memory_free_mb": 361, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 361, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:36:45.824674Z", "memory_used_percent": 85, "memory_free_mb": 293, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 293, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:39:45.822065Z", "cpu_5s_percent": 86, "cpu_1m_percent": 79, "cpu_5m_percent": 69, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 79, "cpu_5m_percent": 69, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:21:45.823524Z", "cpu_5s_percent": 87, "cpu_1m_percent": 99, "cpu_5m_percent": 94, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 99, "cpu_5m_percent": 94, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:37:45.823412Z", "cpu_5s_percent": 98, "cpu_1m_percent": 88, "cpu_5m_percent": 82, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 88, "cpu_5m_percent": 82, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:07:45.822699Z", "cpu_5s_percent": 92, "cpu_1m_percent": 82, "cpu_5m_percent": 84, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 82, "cpu_5m_percent": 84, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:21:45.826888Z", "process": "snmpd", "pid": 1257, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 1257, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:55:45.824217Z", "memory_used_percent": 97, "memory_free_mb": 243, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 243, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:11:45.826921Z", "process": "bgp", "pid": 326, "crash_count_24h": 19, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 326, "crash_count_24h": 19, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T21:20:45.829383Z", "process": "crypto", "pid": 3063, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 3063, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:47:45.824805Z", "memory_used_percent": 99, "memory_free_mb": 305, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 305, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:47:45.825040Z", "memory_used_percent": 84, "memory_free_mb": 460, "memory_total_mb": 8192, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 460, "memory_total_mb": 8192, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:51:45.822705Z", "cpu_5s_percent": 95, "cpu_1m_percent": 77, "cpu_5m_percent": 92, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 77, "cpu_5m_percent": 92, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:50:45.826604Z", "memory_used_percent": 81, "memory_free_mb": 310, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 310, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:00:45.823529Z", "cpu_5s_percent": 92, "cpu_1m_percent": 95, "cpu_5m_percent": 89, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 95, "cpu_5m_percent": 89, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:45:45.823583Z", "cpu_5s_percent": 97, "cpu_1m_percent": 92, "cpu_5m_percent": 78, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 92, "cpu_5m_percent": 78, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:04:45.822815Z", "cpu_5s_percent": 95, "cpu_1m_percent": 95, "cpu_5m_percent": 81, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 95, "cpu_5m_percent": 81, "top_process": "CEF RP"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:28:45.821912Z", "cpu_5s_percent": 85, "cpu_1m_percent": 97, "cpu_5m_percent": 78, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 97, "cpu_5m_percent": 78, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T21:08:45.826464Z", "memory_used_percent": 99, "memory_free_mb": 63, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 63, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:30:45.824796Z", "memory_used_percent": 88, "memory_free_mb": 361, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 361, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:11:45.827349Z", "process": "iosd", "pid": 2946, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 2946, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:08:45.821655Z", "cpu_5s_percent": 92, "cpu_1m_percent": 80, "cpu_5m_percent": 90, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 80, "cpu_5m_percent": 90, "top_process": "Net Background"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:55:45.829601Z", "process": "telemetry", "pid": 328, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 328, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:18:45.828121Z", "process": "ospf", "pid": 801, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 801, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:36:45.823232Z", "cpu_5s_percent": 100, "cpu_1m_percent": 83, "cpu_5m_percent": 95, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 83, "cpu_5m_percent": 95, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:31:45.829780Z", "process": "snmpd", "pid": 875, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "snmpd", "pid": 875, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:12:45.823770Z", "cpu_5s_percent": 89, "cpu_1m_percent": 86, "cpu_5m_percent": 66, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 86, "cpu_5m_percent": 66, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:38:45.827332Z", "process": "bgp", "pid": 4872, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "bgp", "pid": 4872, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:12:45.823388Z", "cpu_5s_percent": 88, "cpu_1m_percent": 87, "cpu_5m_percent": 91, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 87, "cpu_5m_percent": 91, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:41:45.824584Z", "memory_used_percent": 86, "memory_free_mb": 60, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 60, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:09:45.823150Z", "cpu_5s_percent": 94, "cpu_1m_percent": 79, "cpu_5m_percent": 83, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 79, "cpu_5m_percent": 83, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:35:45.822281Z", "cpu_5s_percent": 86, "cpu_1m_percent": 93, "cpu_5m_percent": 95, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 93, "cpu_5m_percent": 95, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:13:45.827383Z", "process": "ospf", "pid": 3679, "crash_count_24h": 10, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3679, "crash_count_24h": 10, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:16:45.824901Z", "memory_used_percent": 85, "memory_free_mb": 137, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 137, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:00:45.823185Z", "cpu_5s_percent": 100, "cpu_1m_percent": 77, "cpu_5m_percent": 77, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 77, "cpu_5m_percent": 77, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:01:45.825457Z", "memory_used_percent": 86, "memory_free_mb": 210, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 210, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:29:45.826135Z", "memory_used_percent": 98, "memory_free_mb": 238, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 238, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:27:45.823911Z", "cpu_5s_percent": 95, "cpu_1m_percent": 93, "cpu_5m_percent": 89, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 93, "cpu_5m_percent": 89, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:08:45.826528Z", "memory_used_percent": 91, "memory_free_mb": 353, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 353, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:37:45.824644Z", "memory_used_percent": 92, "memory_free_mb": 448, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 448, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:15:45.828696Z", "process": "telemetry", "pid": 1425, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "telemetry", "pid": 1425, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:37:45.828278Z", "process": "netconf", "pid": 2203, "crash_count_24h": 7, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2203, "crash_count_24h": 7, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:49:45.824715Z", "memory_used_percent": 99, "memory_free_mb": 221, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 221, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:25:45.823179Z", "cpu_5s_percent": 97, "cpu_1m_percent": 91, "cpu_5m_percent": 71, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 91, "cpu_5m_percent": 71, "top_process": "SNMP ENGINE"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:52:45.822903Z", "cpu_5s_percent": 89, "cpu_1m_percent": 94, "cpu_5m_percent": 71, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 94, "cpu_5m_percent": 71, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:40:45.824545Z", "memory_used_percent": 84, "memory_free_mb": 101, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 101, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:35:45.821931Z", "cpu_5s_percent": 90, "cpu_1m_percent": 92, "cpu_5m_percent": 85, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 92, "cpu_5m_percent": 85, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:02:45.828246Z", "process": "ospf", "pid": 1408, "crash_count_24h": 16, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "ospf", "pid": 1408, "crash_count_24h": 16, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:53:45.825643Z", "memory_used_percent": 97, "memory_free_mb": 183, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 183, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:08:45.828384Z", "process": "crypto", "pid": 2066, "crash_count_24h": 14, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 2066, "crash_count_24h": 14, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:32:45.822270Z", "cpu_5s_percent": 92, "cpu_1m_percent": 99, "cpu_5m_percent": 69, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 99, "cpu_5m_percent": 69, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:47:45.824223Z", "memory_used_percent": 99, "memory_free_mb": 478, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 478, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:39:45.828749Z", "process": "telemetry", "pid": 2743, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "telemetry", "pid": 2743, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:32:45.822207Z", "cpu_5s_percent": 91, "cpu_1m_percent": 91, "cpu_5m_percent": 80, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 91, "cpu_5m_percent": 80, "top_process": "Crypto IKEv2"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:15:45.828534Z", "process": "bgp", "pid": 3062, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "bgp", "pid": 3062, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:59:45.822723Z", "cpu_5s_percent": 92, "cpu_1m_percent": 85, "cpu_5m_percent": 91, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 85, "cpu_5m_percent": 91, "top_process": "ARP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T21:11:45.823108Z", "cpu_5s_percent": 87, "cpu_1m_percent": 78, "cpu_5m_percent": 79, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 78, "cpu_5m_percent": 79, "top_process": "ARP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:03:45.823999Z", "cpu_5s_percent": 85, "cpu_1m_percent": 80, "cpu_5m_percent": 70, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 80, "cpu_5m_percent": 70, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T11:38:45.822909Z", "cpu_5s_percent": 88, "cpu_1m_percent": 82, "cpu_5m_percent": 75, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 82, "cpu_5m_percent": 75, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:43:45.828767Z", "process": "ospf", "pid": 3575, "crash_count_24h": 5, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3575, "crash_count_24h": 5, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:36:45.828625Z", "process": "netconf", "pid": 1149, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 1149, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:53:45.827700Z", "process": "bgp", "pid": 4634, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "bgp", "pid": 4634, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:40:45.824518Z", "memory_used_percent": 82, "memory_free_mb": 453, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 453, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:09:45.821724Z", "cpu_5s_percent": 86, "cpu_1m_percent": 80, "cpu_5m_percent": 75, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 80, "cpu_5m_percent": 75, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:01:45.821805Z", "cpu_5s_percent": 94, "cpu_1m_percent": 89, "cpu_5m_percent": 83, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 89, "cpu_5m_percent": 83, "top_process": "SNMP ENGINE"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:53:45.823799Z", "cpu_5s_percent": 97, "cpu_1m_percent": 93, "cpu_5m_percent": 82, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 93, "cpu_5m_percent": 82, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:28:45.824292Z", "memory_used_percent": 84, "memory_free_mb": 468, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 468, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:09:45.828042Z", "process": "snmpd", "pid": 2768, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 2768, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:54:45.824630Z", "memory_used_percent": 91, "memory_free_mb": 462, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 462, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:07:45.822841Z", "cpu_5s_percent": 92, "cpu_1m_percent": 96, "cpu_5m_percent": 79, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 96, "cpu_5m_percent": 79, "top_process": "SSH Process"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:21:45.823352Z", "cpu_5s_percent": 96, "cpu_1m_percent": 83, "cpu_5m_percent": 83, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 83, "cpu_5m_percent": 83, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:40:45.824638Z", "memory_used_percent": 85, "memory_free_mb": 314, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 314, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:05:45.828367Z", "process": "ospf", "pid": 4539, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "ospf", "pid": 4539, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:48:45.821776Z", "cpu_5s_percent": 92, "cpu_1m_percent": 97, "cpu_5m_percent": 91, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 97, "cpu_5m_percent": 91, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:51:45.822806Z", "cpu_5s_percent": 85, "cpu_1m_percent": 88, "cpu_5m_percent": 66, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 88, "cpu_5m_percent": 66, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:20:45.822037Z", "cpu_5s_percent": 95, "cpu_1m_percent": 75, "cpu_5m_percent": 89, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 75, "cpu_5m_percent": 89, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:38:45.828111Z", "process": "bgp", "pid": 3276, "crash_count_24h": 3, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 3276, "crash_count_24h": 3, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:45:45.829540Z", "process": "snmpd", "pid": 3538, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3538, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:09:45.828264Z", "process": "netconf", "pid": 337, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 337, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:52:45.822592Z", "cpu_5s_percent": 94, "cpu_1m_percent": 87, "cpu_5m_percent": 91, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 87, "cpu_5m_percent": 91, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:05:45.823418Z", "cpu_5s_percent": 98, "cpu_1m_percent": 99, "cpu_5m_percent": 79, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 99, "cpu_5m_percent": 79, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:27:45.823753Z", "cpu_5s_percent": 97, "cpu_1m_percent": 90, "cpu_5m_percent": 87, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 90, "cpu_5m_percent": 87, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:22:45.823261Z", "cpu_5s_percent": 87, "cpu_1m_percent": 98, "cpu_5m_percent": 89, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 98, "cpu_5m_percent": 89, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T21:04:45.826429Z", "memory_used_percent": 95, "memory_free_mb": 437, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 437, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:16:45.828704Z", "process": "crypto", "pid": 3822, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 3822, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:24:45.825993Z", "memory_used_percent": 88, "memory_free_mb": 481, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 481, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:53:45.829330Z", "process": "iosd", "pid": 1615, "crash_count_24h": 25, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 1615, "crash_count_24h": 25, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:58:45.825625Z", "memory_used_percent": 86, "memory_free_mb": 427, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 427, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:36:45.825788Z", "memory_used_percent": 95, "memory_free_mb": 94, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 94, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:09:45.827707Z", "process": "ospf", "pid": 3815, "crash_count_24h": 19, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3815, "crash_count_24h": 19, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:35:45.828500Z", "process": "iosd", "pid": 3666, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3666, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:04:45.824980Z", "memory_used_percent": 84, "memory_free_mb": 428, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 428, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:58:45.822735Z", "cpu_5s_percent": 96, "cpu_1m_percent": 75, "cpu_5m_percent": 93, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 75, "cpu_5m_percent": 93, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:47:45.828191Z", "process": "ospf", "pid": 631, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 631, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:06:45.827749Z", "process": "crypto", "pid": 3453, "crash_count_24h": 5, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 3453, "crash_count_24h": 5, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:34:45.824395Z", "memory_used_percent": 80, "memory_free_mb": 481, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 481, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:12:45.825053Z", "memory_used_percent": 98, "memory_free_mb": 97, "memory_total_mb": 1024, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 97, "memory_total_mb": 1024, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:27:45.825144Z", "memory_used_percent": 80, "memory_free_mb": 444, "memory_total_mb": 8192, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 444, "memory_total_mb": 8192, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:20:45.825559Z", "memory_used_percent": 80, "memory_free_mb": 139, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 139, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:54:45.829505Z", "process": "iosd", "pid": 2728, "crash_count_24h": 17, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "iosd", "pid": 2728, "crash_count_24h": 17, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:01:45.822783Z", "cpu_5s_percent": 92, "cpu_1m_percent": 95, "cpu_5m_percent": 82, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 95, "cpu_5m_percent": 82, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T11:31:45.825670Z", "memory_used_percent": 90, "memory_free_mb": 77, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 77, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:46:45.826340Z", "memory_used_percent": 99, "memory_free_mb": 100, "memory_total_mb": 8192, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 100, "memory_total_mb": 8192, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:21:45.829318Z", "process": "iosd", "pid": 4015, "crash_count_24h": 18, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4015, "crash_count_24h": 18, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:21:45.822873Z", "cpu_5s_percent": 98, "cpu_1m_percent": 99, "cpu_5m_percent": 89, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 99, "cpu_5m_percent": 89, "top_process": "SNMP ENGINE"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:46:45.821747Z", "cpu_5s_percent": 89, "cpu_1m_percent": 88, "cpu_5m_percent": 76, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 88, "cpu_5m_percent": 76, "top_process": "IP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:21:45.822009Z", "cpu_5s_percent": 85, "cpu_1m_percent": 90, "cpu_5m_percent": 95, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 90, "cpu_5m_percent": 95, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:05:45.824144Z", "memory_used_percent": 89, "memory_free_mb": 383, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 383, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:35:45.822417Z", "cpu_5s_percent": 86, "cpu_1m_percent": 92, "cpu_5m_percent": 94, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 92, "cpu_5m_percent": 94, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:39:45.822554Z", "cpu_5s_percent": 95, "cpu_1m_percent": 75, "cpu_5m_percent": 70, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 75, "cpu_5m_percent": 70, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:42:45.828935Z", "process": "crypto", "pid": 4978, "crash_count_24h": 14, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 4978, "crash_count_24h": 14, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:31:45.828469Z", "process": "crypto", "pid": 3633, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 3633, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:07:45.828027Z", "process": "telemetry", "pid": 2495, "crash_count_24h": 18, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 2495, "crash_count_24h": 18, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:39:45.825540Z", "memory_used_percent": 94, "memory_free_mb": 301, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 301, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:17:45.823454Z", "cpu_5s_percent": 94, "cpu_1m_percent": 78, "cpu_5m_percent": 65, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 78, "cpu_5m_percent": 65, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:25:45.823589Z", "cpu_5s_percent": 88, "cpu_1m_percent": 95, "cpu_5m_percent": 79, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 95, "cpu_5m_percent": 79, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:34:45.827159Z", "process": "bgp", "pid": 1812, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 1812, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:52:45.822229Z", "cpu_5s_percent": 93, "cpu_1m_percent": 95, "cpu_5m_percent": 83, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 95, "cpu_5m_percent": 83, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T21:28:45.828799Z", "process": "iosd", "pid": 3031, "crash_count_24h": 5, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3031, "crash_count_24h": 5, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:37:45.828544Z", "process": "netconf", "pid": 4179, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4179, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:48:45.826622Z", "memory_used_percent": 90, "memory_free_mb": 377, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 377, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:31:45.822573Z", "cpu_5s_percent": 96, "cpu_1m_percent": 88, "cpu_5m_percent": 70, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 88, "cpu_5m_percent": 70, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:01:45.829346Z", "process": "bgp", "pid": 3001, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 3001, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T11:47:45.828947Z", "process": "iosd", "pid": 3792, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "iosd", "pid": 3792, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:06:45.825180Z", "memory_used_percent": 84, "memory_free_mb": 205, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 205, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:52:45.823091Z", "cpu_5s_percent": 95, "cpu_1m_percent": 79, "cpu_5m_percent": 91, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 79, "cpu_5m_percent": 91, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:12:45.829551Z", "process": "crypto", "pid": 1472, "crash_count_24h": 4, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "crypto", "pid": 1472, "crash_count_24h": 4, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:57:45.826208Z", "memory_used_percent": 91, "memory_free_mb": 384, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 384, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:23:45.825608Z", "memory_used_percent": 90, "memory_free_mb": 148, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 148, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:28:45.823869Z", "cpu_5s_percent": 97, "cpu_1m_percent": 89, "cpu_5m_percent": 77, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 89, "cpu_5m_percent": 77, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:36:45.823946Z", "cpu_5s_percent": 99, "cpu_1m_percent": 87, "cpu_5m_percent": 90, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 87, "cpu_5m_percent": 90, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:57:45.828992Z", "process": "snmpd", "pid": 3857, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3857, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:11:45.826154Z", "memory_used_percent": 82, "memory_free_mb": 355, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 355, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:48:45.822050Z", "cpu_5s_percent": 97, "cpu_1m_percent": 75, "cpu_5m_percent": 85, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 75, "cpu_5m_percent": 85, "top_process": "IP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:39:45.822891Z", "cpu_5s_percent": 95, "cpu_1m_percent": 98, "cpu_5m_percent": 74, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 98, "cpu_5m_percent": 74, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:11:45.823120Z", "cpu_5s_percent": 87, "cpu_1m_percent": 89, "cpu_5m_percent": 70, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 89, "cpu_5m_percent": 70, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:12:45.825113Z", "memory_used_percent": 90, "memory_free_mb": 70, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 70, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:39:45.823073Z", "cpu_5s_percent": 95, "cpu_1m_percent": 98, "cpu_5m_percent": 65, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 98, "cpu_5m_percent": 65, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:14:45.827340Z", "process": "iosd", "pid": 2809, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 2809, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:57:45.826087Z", "memory_used_percent": 97, "memory_free_mb": 280, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 280, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:19:45.826911Z", "process": "ospf", "pid": 2941, "crash_count_24h": 4, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 2941, "crash_count_24h": 4, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T11:42:45.824316Z", "memory_used_percent": 94, "memory_free_mb": 127, "memory_total_mb": 8192, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 127, "memory_total_mb": 8192, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:28:45.823435Z", "cpu_5s_percent": 95, "cpu_1m_percent": 83, "cpu_5m_percent": 83, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 83, "cpu_5m_percent": 83, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:43:45.829449Z", "process": "bgp", "pid": 1323, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 1323, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:38:45.826832Z", "process": "netconf", "pid": 2343, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2343, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:49:45.828903Z", "process": "telemetry", "pid": 4104, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 4104, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:15:45.829358Z", "process": "netconf", "pid": 3956, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "netconf", "pid": 3956, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:11:45.828662Z", "process": "snmpd", "pid": 4054, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "snmpd", "pid": 4054, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:49:45.824943Z", "memory_used_percent": 89, "memory_free_mb": 288, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 288, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:02:45.826038Z", "memory_used_percent": 91, "memory_free_mb": 351, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 351, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:22:45.829701Z", "process": "netconf", "pid": 2666, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "netconf", "pid": 2666, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:24:45.826366Z", "memory_used_percent": 92, "memory_free_mb": 282, "memory_total_mb": 4096, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 282, "memory_total_mb": 4096, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:48:45.828843Z", "process": "telemetry", "pid": 882, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "telemetry", "pid": 882, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:15:45.823787Z", "cpu_5s_percent": 87, "cpu_1m_percent": 75, "cpu_5m_percent": 76, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 75, "cpu_5m_percent": 76, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:24:45.823564Z", "cpu_5s_percent": 91, "cpu_1m_percent": 90, "cpu_5m_percent": 85, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 90, "cpu_5m_percent": 85, "top_process": "SNMP ENGINE"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:28:45.821712Z", "cpu_5s_percent": 100, "cpu_1m_percent": 92, "cpu_5m_percent": 89, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 92, "cpu_5m_percent": 89, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:18:45.828149Z", "process": "bgp", "pid": 3935, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "bgp", "pid": 3935, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:36:45.828181Z", "process": "telemetry", "pid": 836, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 836, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:10:45.828415Z", "process": "netconf", "pid": 2041, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2041, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:16:45.821636Z", "cpu_5s_percent": 91, "cpu_1m_percent": 99, "cpu_5m_percent": 86, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 99, "cpu_5m_percent": 86, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:38:45.827582Z", "process": "bgp", "pid": 2350, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 2350, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:32:45.829722Z", "process": "netconf", "pid": 1367, "crash_count_24h": 14, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "netconf", "pid": 1367, "crash_count_24h": 14, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:05:45.823068Z", "cpu_5s_percent": 98, "cpu_1m_percent": 77, "cpu_5m_percent": 91, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 77, "cpu_5m_percent": 91, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:02:45.823894Z", "cpu_5s_percent": 92, "cpu_1m_percent": 99, "cpu_5m_percent": 66, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 99, "cpu_5m_percent": 66, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:12:45.825278Z", "memory_used_percent": 81, "memory_free_mb": 289, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 289, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:59:45.821996Z", "cpu_5s_percent": 100, "cpu_1m_percent": 86, "cpu_5m_percent": 66, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 86, "cpu_5m_percent": 66, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:00:45.824662Z", "memory_used_percent": 87, "memory_free_mb": 334, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 334, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:19:45.821758Z", "cpu_5s_percent": 99, "cpu_1m_percent": 86, "cpu_5m_percent": 77, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 86, "cpu_5m_percent": 77, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:39:45.828067Z", "process": "netconf", "pid": 829, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 829, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T21:27:45.828829Z", "process": "snmpd", "pid": 1056, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "snmpd", "pid": 1056, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:28:45.827795Z", "process": "iosd", "pid": 4692, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4692, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:07:45.822582Z", "cpu_5s_percent": 96, "cpu_1m_percent": 80, "cpu_5m_percent": 83, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 80, "cpu_5m_percent": 83, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:06:45.823577Z", "cpu_5s_percent": 99, "cpu_1m_percent": 97, "cpu_5m_percent": 94, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 97, "cpu_5m_percent": 94, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T21:08:45.821889Z", "cpu_5s_percent": 100, "cpu_1m_percent": 89, "cpu_5m_percent": 88, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 89, "cpu_5m_percent": 88, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:07:45.828142Z", "process": "telemetry", "pid": 4077, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 4077, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:48:45.828896Z", "process": "telemetry", "pid": 3816, "crash_count_24h": 3, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 3816, "crash_count_24h": 3, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:21:45.829530Z", "process": "snmpd", "pid": 4137, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4137, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:36:45.829732Z", "process": "ospf", "pid": 197, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 197, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:55:45.828517Z", "process": "ospf", "pid": 3393, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "ospf", "pid": 3393, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:19:45.825901Z", "memory_used_percent": 95, "memory_free_mb": 364, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 364, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T11:53:45.826545Z", "memory_used_percent": 91, "memory_free_mb": 394, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 394, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T21:19:45.824436Z", "memory_used_percent": 80, "memory_free_mb": 292, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 292, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:58:45.823793Z", "cpu_5s_percent": 87, "cpu_1m_percent": 83, "cpu_5m_percent": 93, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 83, "cpu_5m_percent": 93, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:04:45.822517Z", "cpu_5s_percent": 87, "cpu_1m_percent": 83, "cpu_5m_percent": 82, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 83, "cpu_5m_percent": 82, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:23:45.823155Z", "cpu_5s_percent": 88, "cpu_1m_percent": 98, "cpu_5m_percent": 94, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 98, "cpu_5m_percent": 94, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:59:45.826228Z", "memory_used_percent": 87, "memory_free_mb": 439, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 439, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:38:45.821700Z", "cpu_5s_percent": 90, "cpu_1m_percent": 99, "cpu_5m_percent": 86, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 99, "cpu_5m_percent": 86, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:47:45.821676Z", "cpu_5s_percent": 99, "cpu_1m_percent": 98, "cpu_5m_percent": 94, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 98, "cpu_5m_percent": 94, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:28:45.823822Z", "cpu_5s_percent": 97, "cpu_1m_percent": 93, "cpu_5m_percent": 93, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 93, "cpu_5m_percent": 93, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T21:08:45.828741Z", "process": "crypto", "pid": 1756, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1756, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:20:45.829758Z", "process": "snmpd", "pid": 2030, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 2030, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:59:45.829752Z", "process": "ospf", "pid": 4717, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "ospf", "pid": 4717, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:05:45.823888Z", "cpu_5s_percent": 98, "cpu_1m_percent": 79, "cpu_5m_percent": 77, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 79, "cpu_5m_percent": 77, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:54:45.825122Z", "memory_used_percent": 84, "memory_free_mb": 491, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 491, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:53:45.824859Z", "memory_used_percent": 94, "memory_free_mb": 353, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 353, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:36:45.829463Z", "process": "bgp", "pid": 154, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "bgp", "pid": 154, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T21:04:45.824168Z", "memory_used_percent": 88, "memory_free_mb": 441, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 441, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:22:45.829471Z", "process": "netconf", "pid": 1249, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 1249, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:31:45.823381Z", "cpu_5s_percent": 86, "cpu_1m_percent": 99, "cpu_5m_percent": 69, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 99, "cpu_5m_percent": 69, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:38:45.825679Z", "memory_used_percent": 98, "memory_free_mb": 299, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 299, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:13:45.824871Z", "memory_used_percent": 80, "memory_free_mb": 488, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 488, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:46:45.827694Z", "process": "iosd", "pid": 1358, "crash_count_24h": 20, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 1358, "crash_count_24h": 20, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:48:45.826523Z", "memory_used_percent": 91, "memory_free_mb": 453, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 453, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:00:45.828170Z", "process": "iosd", "pid": 4022, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4022, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:52:45.826935Z", "process": "snmpd", "pid": 739, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 739, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:51:45.828970Z", "process": "netconf", "pid": 2571, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2571, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:06:45.827540Z", "process": "telemetry", "pid": 1520, "crash_count_24h": 10, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "telemetry", "pid": 1520, "crash_count_24h": 10, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:12:45.827607Z", "process": "telemetry", "pid": 898, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 898, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:28:45.826402Z", "memory_used_percent": 82, "memory_free_mb": 392, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 392, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:47:45.822717Z", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 87, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 87, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:32:45.828651Z", "process": "iosd", "pid": 1667, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 1667, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:08:45.823963Z", "cpu_5s_percent": 92, "cpu_1m_percent": 95, "cpu_5m_percent": 91, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 95, "cpu_5m_percent": 91, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:25:45.828645Z", "process": "iosd", "pid": 4751, "crash_count_24h": 21, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4751, "crash_count_24h": 21, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:28:45.822424Z", "cpu_5s_percent": 98, "cpu_1m_percent": 93, "cpu_5m_percent": 85, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 93, "cpu_5m_percent": 85, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:10:45.828303Z", "process": "netconf", "pid": 1737, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "netconf", "pid": 1737, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:55:45.824455Z", "memory_used_percent": 84, "memory_free_mb": 290, "memory_total_mb": 4096, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 290, "memory_total_mb": 4096, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:15:45.824262Z", "memory_used_percent": 81, "memory_free_mb": 321, "memory_total_mb": 8192, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 321, "memory_total_mb": 8192, "top_consumer": "telemetry"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:48:45.825326Z", "memory_used_percent": 83, "memory_free_mb": 353, "memory_total_mb": 2048, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 353, "memory_total_mb": 2048, "top_consumer": "cef"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T21:11:45.824733Z", "memory_used_percent": 91, "memory_free_mb": 160, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 160, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:18:45.823776Z", "cpu_5s_percent": 98, "cpu_1m_percent": 95, "cpu_5m_percent": 72, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 95, "cpu_5m_percent": 72, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:05:45.825059Z", "memory_used_percent": 88, "memory_free_mb": 95, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 95, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:20:45.824774Z", "memory_used_percent": 82, "memory_free_mb": 469, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 469, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:15:45.821795Z", "cpu_5s_percent": 91, "cpu_1m_percent": 95, "cpu_5m_percent": 78, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 95, "cpu_5m_percent": 78, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:57:45.825374Z", "memory_used_percent": 92, "memory_free_mb": 389, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 389, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:16:45.823280Z", "cpu_5s_percent": 98, "cpu_1m_percent": 99, "cpu_5m_percent": 72, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 99, "cpu_5m_percent": 72, "top_process": "CEF RP"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:20:45.823606Z", "cpu_5s_percent": 95, "cpu_1m_percent": 78, "cpu_5m_percent": 83, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 78, "cpu_5m_percent": 83, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:51:45.823298Z", "cpu_5s_percent": 88, "cpu_1m_percent": 78, "cpu_5m_percent": 69, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 78, "cpu_5m_percent": 69, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:33:45.825910Z", "memory_used_percent": 85, "memory_free_mb": 351, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 351, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:49:45.826986Z", "process": "bgp", "pid": 365, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "bgp", "pid": 365, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:55:45.826271Z", "memory_used_percent": 96, "memory_free_mb": 237, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 237, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:48:45.823478Z", "cpu_5s_percent": 89, "cpu_1m_percent": 82, "cpu_5m_percent": 86, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 82, "cpu_5m_percent": 86, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:17:45.823509Z", "cpu_5s_percent": 85, "cpu_1m_percent": 93, "cpu_5m_percent": 77, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 93, "cpu_5m_percent": 77, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:51:45.827169Z", "process": "netconf", "pid": 1261, "crash_count_24h": 20, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 1261, "crash_count_24h": 20, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:40:45.824097Z", "memory_used_percent": 85, "memory_free_mb": 205, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 205, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:07:45.827768Z", "process": "bgp", "pid": 2535, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "bgp", "pid": 2535, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:24:45.825881Z", "memory_used_percent": 91, "memory_free_mb": 271, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 271, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:48:45.827807Z", "process": "crypto", "pid": 4192, "crash_count_24h": 23, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 4192, "crash_count_24h": 23, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:57:45.826011Z", "memory_used_percent": 93, "memory_free_mb": 245, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 245, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:56:45.824705Z", "memory_used_percent": 86, "memory_free_mb": 411, "memory_total_mb": 1024, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 411, "memory_total_mb": 1024, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:12:45.824552Z", "memory_used_percent": 91, "memory_free_mb": 320, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 320, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:26:45.823009Z", "cpu_5s_percent": 100, "cpu_1m_percent": 91, "cpu_5m_percent": 70, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 91, "cpu_5m_percent": 70, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T11:39:45.827492Z", "process": "netconf", "pid": 1436, "crash_count_24h": 25, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 1436, "crash_count_24h": 25, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:29:45.828506Z", "process": "ospf", "pid": 3508, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3508, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:12:45.828379Z", "process": "iosd", "pid": 3784, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3784, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:50:45.822411Z", "cpu_5s_percent": 99, "cpu_1m_percent": 82, "cpu_5m_percent": 92, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 82, "cpu_5m_percent": 92, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:49:45.822528Z", "cpu_5s_percent": 85, "cpu_1m_percent": 99, "cpu_5m_percent": 76, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 99, "cpu_5m_percent": 76, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:45:45.829392Z", "process": "bgp", "pid": 3493, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "bgp", "pid": 3493, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:04:45.827087Z", "process": "netconf", "pid": 692, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 692, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:14:45.825872Z", "memory_used_percent": 93, "memory_free_mb": 224, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 224, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:50:45.827138Z", "process": "crypto", "pid": 4227, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 4227, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:42:45.823741Z", "cpu_5s_percent": 98, "cpu_1m_percent": 84, "cpu_5m_percent": 69, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 84, "cpu_5m_percent": 69, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:13:45.825718Z", "memory_used_percent": 81, "memory_free_mb": 438, "memory_total_mb": 1024, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 438, "memory_total_mb": 1024, "top_consumer": "qos"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:29:45.826312Z", "memory_used_percent": 96, "memory_free_mb": 308, "memory_total_mb": 4096, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 308, "memory_total_mb": 4096, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:01:45.829521Z", "process": "snmpd", "pid": 1481, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "snmpd", "pid": 1481, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:27:45.823688Z", "cpu_5s_percent": 86, "cpu_1m_percent": 80, "cpu_5m_percent": 76, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 80, "cpu_5m_percent": 76, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:20:45.823347Z", "cpu_5s_percent": 96, "cpu_1m_percent": 78, "cpu_5m_percent": 86, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 78, "cpu_5m_percent": 86, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:45:45.825201Z", "memory_used_percent": 97, "memory_free_mb": 255, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 255, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:36:45.826581Z", "memory_used_percent": 91, "memory_free_mb": 100, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 100, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:56:45.822999Z", "cpu_5s_percent": 90, "cpu_1m_percent": 95, "cpu_5m_percent": 78, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 95, "cpu_5m_percent": 78, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T21:28:45.827864Z", "process": "telemetry", "pid": 4478, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 4478, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:39:45.825093Z", "memory_used_percent": 88, "memory_free_mb": 390, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 390, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:10:45.823804Z", "cpu_5s_percent": 88, "cpu_1m_percent": 86, "cpu_5m_percent": 75, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 86, "cpu_5m_percent": 75, "top_process": "IP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:33:45.827871Z", "process": "ospf", "pid": 4665, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "ospf", "pid": 4665, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:23:45.827053Z", "process": "telemetry", "pid": 1533, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 1533, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:58:45.827565Z", "process": "bgp", "pid": 4879, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 4879, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:26:45.824912Z", "memory_used_percent": 95, "memory_free_mb": 112, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 112, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:58:45.828450Z", "process": "crypto", "pid": 3677, "crash_count_24h": 12, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 3677, "crash_count_24h": 12, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:17:45.826375Z", "memory_used_percent": 87, "memory_free_mb": 268, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 268, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:43:45.827017Z", "process": "crypto", "pid": 1942, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 1942, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:46:45.826663Z", "memory_used_percent": 99, "memory_free_mb": 77, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 77, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:39:45.827944Z", "process": "telemetry", "pid": 4372, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 4372, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:41:45.827473Z", "process": "snmpd", "pid": 3787, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3787, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:39:45.822834Z", "cpu_5s_percent": 89, "cpu_1m_percent": 87, "cpu_5m_percent": 90, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 87, "cpu_5m_percent": 90, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:52:45.823226Z", "cpu_5s_percent": 88, "cpu_1m_percent": 78, "cpu_5m_percent": 82, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 78, "cpu_5m_percent": 82, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:47:45.825162Z", "memory_used_percent": 82, "memory_free_mb": 71, "memory_total_mb": 2048, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 71, "memory_total_mb": 2048, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:15:45.827951Z", "process": "telemetry", "pid": 3069, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 3069, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:46:45.824746Z", "memory_used_percent": 84, "memory_free_mb": 129, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 129, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:17:45.823729Z", "cpu_5s_percent": 89, "cpu_1m_percent": 93, "cpu_5m_percent": 77, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 93, "cpu_5m_percent": 77, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:02:45.829709Z", "process": "ospf", "pid": 4667, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "ospf", "pid": 4667, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:19:45.829585Z", "process": "iosd", "pid": 3397, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3397, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:48:45.823781Z", "cpu_5s_percent": 96, "cpu_1m_percent": 84, "cpu_5m_percent": 74, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 84, "cpu_5m_percent": 74, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:08:45.827914Z", "process": "snmpd", "pid": 1062, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 1062, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:56:45.825549Z", "memory_used_percent": 87, "memory_free_mb": 222, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 222, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:14:45.823220Z", "cpu_5s_percent": 93, "cpu_1m_percent": 85, "cpu_5m_percent": 90, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 85, "cpu_5m_percent": 90, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:34:45.823203Z", "cpu_5s_percent": 91, "cpu_1m_percent": 89, "cpu_5m_percent": 72, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 89, "cpu_5m_percent": 72, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:39:45.823038Z", "cpu_5s_percent": 88, "cpu_1m_percent": 89, "cpu_5m_percent": 81, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 89, "cpu_5m_percent": 81, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:46:45.829673Z", "process": "netconf", "pid": 4017, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "netconf", "pid": 4017, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:34:45.822249Z", "cpu_5s_percent": 97, "cpu_1m_percent": 97, "cpu_5m_percent": 94, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 97, "cpu_5m_percent": 94, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:04:45.828756Z", "process": "snmpd", "pid": 3657, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3657, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:58:45.827986Z", "process": "bgp", "pid": 2985, "crash_count_24h": 7, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 2985, "crash_count_24h": 7, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:34:45.825921Z", "memory_used_percent": 83, "memory_free_mb": 453, "memory_total_mb": 4096, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 453, "memory_total_mb": 4096, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:28:45.828835Z", "process": "iosd", "pid": 3413, "crash_count_24h": 24, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3413, "crash_count_24h": 24, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:27:45.825770Z", "memory_used_percent": 95, "memory_free_mb": 429, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 429, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:49:45.827958Z", "process": "netconf", "pid": 4934, "crash_count_24h": 6, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4934, "crash_count_24h": 6, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:01:45.825269Z", "memory_used_percent": 80, "memory_free_mb": 219, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 219, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:11:45.823447Z", "cpu_5s_percent": 98, "cpu_1m_percent": 92, "cpu_5m_percent": 81, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 92, "cpu_5m_percent": 81, "top_process": "CEF RP"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:51:45.823250Z", "cpu_5s_percent": 99, "cpu_1m_percent": 77, "cpu_5m_percent": 67, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 77, "cpu_5m_percent": 67, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:53:45.822885Z", "cpu_5s_percent": 98, "cpu_1m_percent": 79, "cpu_5m_percent": 92, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 79, "cpu_5m_percent": 92, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:02:45.823951Z", "cpu_5s_percent": 91, "cpu_1m_percent": 83, "cpu_5m_percent": 93, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 83, "cpu_5m_percent": 93, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T21:16:45.823131Z", "cpu_5s_percent": 100, "cpu_1m_percent": 97, "cpu_5m_percent": 79, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 97, "cpu_5m_percent": 79, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:31:45.826384Z", "memory_used_percent": 95, "memory_free_mb": 362, "memory_total_mb": 8192, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 362, "memory_total_mb": 8192, "top_consumer": "qos"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:01:45.825022Z", "memory_used_percent": 91, "memory_free_mb": 449, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 449, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:23:45.827118Z", "process": "crypto", "pid": 549, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 549, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:50:45.824598Z", "memory_used_percent": 87, "memory_free_mb": 251, "memory_total_mb": 1024, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 251, "memory_total_mb": 1024, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:02:45.825174Z", "memory_used_percent": 82, "memory_free_mb": 314, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 314, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:55:45.827725Z", "process": "iosd", "pid": 1377, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 1377, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:21:45.825948Z", "memory_used_percent": 92, "memory_free_mb": 234, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 234, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:40:45.826021Z", "memory_used_percent": 86, "memory_free_mb": 143, "memory_total_mb": 2048, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 143, "memory_total_mb": 2048, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:51:45.822056Z", "cpu_5s_percent": 99, "cpu_1m_percent": 92, "cpu_5m_percent": 81, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 92, "cpu_5m_percent": 81, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:53:45.826487Z", "memory_used_percent": 97, "memory_free_mb": 418, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 418, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:45:45.825652Z", "memory_used_percent": 87, "memory_free_mb": 142, "memory_total_mb": 8192, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 142, "memory_total_mb": 8192, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:24:45.828979Z", "process": "iosd", "pid": 3247, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "iosd", "pid": 3247, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:15:45.823044Z", "cpu_5s_percent": 87, "cpu_1m_percent": 76, "cpu_5m_percent": 90, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 76, "cpu_5m_percent": 90, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:02:45.824333Z", "memory_used_percent": 82, "memory_free_mb": 458, "memory_total_mb": 4096, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 458, "memory_total_mb": 4096, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:11:45.823144Z", "cpu_5s_percent": 94, "cpu_1m_percent": 86, "cpu_5m_percent": 79, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 86, "cpu_5m_percent": 79, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:17:45.828709Z", "process": "ospf", "pid": 411, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 411, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:41:45.826263Z", "memory_used_percent": 90, "memory_free_mb": 276, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 276, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:40:45.822456Z", "cpu_5s_percent": 86, "cpu_1m_percent": 81, "cpu_5m_percent": 67, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 81, "cpu_5m_percent": 67, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:53:45.824727Z", "memory_used_percent": 84, "memory_free_mb": 419, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 419, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:08:45.826125Z", "memory_used_percent": 95, "memory_free_mb": 58, "memory_total_mb": 4096, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 58, "memory_total_mb": 4096, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:38:45.823406Z", "cpu_5s_percent": 92, "cpu_1m_percent": 85, "cpu_5m_percent": 84, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 85, "cpu_5m_percent": 84, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:11:45.827881Z", "process": "netconf", "pid": 4004, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "netconf", "pid": 4004, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:12:45.827743Z", "process": "snmpd", "pid": 1716, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "snmpd", "pid": 1716, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:27:45.823905Z", "cpu_5s_percent": 93, "cpu_1m_percent": 98, "cpu_5m_percent": 70, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 98, "cpu_5m_percent": 70, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:55:45.826348Z", "memory_used_percent": 88, "memory_free_mb": 103, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 103, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:46:45.822656Z", "cpu_5s_percent": 96, "cpu_1m_percent": 95, "cpu_5m_percent": 73, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 95, "cpu_5m_percent": 73, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:06:45.826865Z", "process": "netconf", "pid": 1804, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "netconf", "pid": 1804, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:35:45.826143Z", "memory_used_percent": 81, "memory_free_mb": 382, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 382, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:43:45.824116Z", "memory_used_percent": 85, "memory_free_mb": 311, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 311, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:53:45.827068Z", "process": "ospf", "pid": 1426, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 1426, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:09:45.824323Z", "memory_used_percent": 94, "memory_free_mb": 465, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 465, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T21:17:45.826455Z", "memory_used_percent": 97, "memory_free_mb": 93, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 93, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:06:45.827856Z", "process": "crypto", "pid": 2025, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 2025, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:01:45.823334Z", "cpu_5s_percent": 90, "cpu_1m_percent": 78, "cpu_5m_percent": 80, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 78, "cpu_5m_percent": 80, "top_process": "SSH Process"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:32:45.828128Z", "process": "netconf", "pid": 190, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 190, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:56:45.824466Z", "memory_used_percent": 81, "memory_free_mb": 138, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 138, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:49:45.828004Z", "process": "crypto", "pid": 3434, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 3434, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:42:45.826638Z", "memory_used_percent": 98, "memory_free_mb": 349, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 349, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:34:45.822474Z", "cpu_5s_percent": 92, "cpu_1m_percent": 79, "cpu_5m_percent": 88, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 79, "cpu_5m_percent": 88, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:57:45.827043Z", "process": "iosd", "pid": 269, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 269, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:40:45.828396Z", "process": "crypto", "pid": 3232, "crash_count_24h": 23, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "crypto", "pid": 3232, "crash_count_24h": 23, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:40:45.827906Z", "process": "ospf", "pid": 4937, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 4937, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:24:45.827073Z", "process": "snmpd", "pid": 2228, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 2228, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:17:45.828814Z", "process": "netconf", "pid": 4823, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "netconf", "pid": 4823, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:27:45.822239Z", "cpu_5s_percent": 90, "cpu_1m_percent": 79, "cpu_5m_percent": 76, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 79, "cpu_5m_percent": 76, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:12:45.823595Z", "cpu_5s_percent": 89, "cpu_1m_percent": 79, "cpu_5m_percent": 68, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 79, "cpu_5m_percent": 68, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:53:45.826511Z", "memory_used_percent": 99, "memory_free_mb": 474, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 474, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:24:45.829678Z", "process": "iosd", "pid": 3346, "crash_count_24h": 18, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "iosd", "pid": 3346, "crash_count_24h": 18, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:26:45.828680Z", "process": "iosd", "pid": 4013, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4013, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:14:45.822376Z", "cpu_5s_percent": 100, "cpu_1m_percent": 95, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 95, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:13:45.829741Z", "process": "bgp", "pid": 622, "crash_count_24h": 4, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "bgp", "pid": 622, "crash_count_24h": 4, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:04:45.823735Z", "cpu_5s_percent": 89, "cpu_1m_percent": 80, "cpu_5m_percent": 82, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 80, "cpu_5m_percent": 82, "top_process": "IP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:18:45.824576Z", "memory_used_percent": 97, "memory_free_mb": 147, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 147, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T21:20:45.825210Z", "memory_used_percent": 86, "memory_free_mb": 91, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 91, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:10:45.822933Z", "cpu_5s_percent": 87, "cpu_1m_percent": 84, "cpu_5m_percent": 66, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 84, "cpu_5m_percent": 66, "top_process": "SSH Process"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:38:45.826551Z", "memory_used_percent": 99, "memory_free_mb": 379, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 379, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:07:45.825167Z", "memory_used_percent": 91, "memory_free_mb": 62, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 62, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:27:45.822218Z", "cpu_5s_percent": 97, "cpu_1m_percent": 98, "cpu_5m_percent": 77, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 98, "cpu_5m_percent": 77, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:03:45.828134Z", "process": "snmpd", "pid": 3693, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3693, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:32:45.825760Z", "memory_used_percent": 98, "memory_free_mb": 399, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 399, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:44:45.823316Z", "cpu_5s_percent": 93, "cpu_1m_percent": 76, "cpu_5m_percent": 72, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 76, "cpu_5m_percent": 72, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:11:45.824528Z", "memory_used_percent": 97, "memory_free_mb": 139, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 139, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:16:45.828154Z", "process": "bgp", "pid": 2459, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "bgp", "pid": 2459, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:09:45.823292Z", "cpu_5s_percent": 87, "cpu_1m_percent": 83, "cpu_5m_percent": 87, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 83, "cpu_5m_percent": 87, "top_process": "CEF RP"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:56:45.825890Z", "memory_used_percent": 86, "memory_free_mb": 389, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 389, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:59:45.823665Z", "cpu_5s_percent": 95, "cpu_1m_percent": 77, "cpu_5m_percent": 90, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 77, "cpu_5m_percent": 90, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:24:45.829324Z", "process": "telemetry", "pid": 2536, "crash_count_24h": 22, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 2536, "crash_count_24h": 22, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:08:45.823062Z", "cpu_5s_percent": 88, "cpu_1m_percent": 91, "cpu_5m_percent": 84, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 91, "cpu_5m_percent": 84, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:01:45.822335Z", "cpu_5s_percent": 85, "cpu_1m_percent": 92, "cpu_5m_percent": 85, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 92, "cpu_5m_percent": 85, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:51:45.828105Z", "process": "telemetry", "pid": 3256, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 3256, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:53:45.823940Z", "cpu_5s_percent": 94, "cpu_1m_percent": 85, "cpu_5m_percent": 69, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 85, "cpu_5m_percent": 69, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:08:45.822367Z", "cpu_5s_percent": 85, "cpu_1m_percent": 96, "cpu_5m_percent": 88, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 96, "cpu_5m_percent": 88, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:45:45.826200Z", "memory_used_percent": 84, "memory_free_mb": 53, "memory_total_mb": 4096, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 53, "memory_total_mb": 4096, "top_consumer": "ospf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:27:45.824650Z", "memory_used_percent": 91, "memory_free_mb": 448, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 448, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:32:45.823558Z", "cpu_5s_percent": 91, "cpu_1m_percent": 88, "cpu_5m_percent": 75, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 88, "cpu_5m_percent": 75, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:01:45.825102Z", "memory_used_percent": 94, "memory_free_mb": 72, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 72, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:58:45.826877Z", "process": "iosd", "pid": 4508, "crash_count_24h": 7, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4508, "crash_count_24h": 7, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:14:45.827936Z", "process": "crypto", "pid": 2827, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 2827, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T11:34:45.828735Z", "process": "telemetry", "pid": 2224, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 2224, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:18:45.826191Z", "memory_used_percent": 81, "memory_free_mb": 396, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 396, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:43:45.823490Z", "cpu_5s_percent": 95, "cpu_1m_percent": 79, "cpu_5m_percent": 95, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 79, "cpu_5m_percent": 95, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:16:45.823683Z", "cpu_5s_percent": 98, "cpu_1m_percent": 95, "cpu_5m_percent": 90, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 95, "cpu_5m_percent": 90, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:49:45.822565Z", "cpu_5s_percent": 89, "cpu_1m_percent": 77, "cpu_5m_percent": 94, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 77, "cpu_5m_percent": 94, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:48:45.821767Z", "cpu_5s_percent": 91, "cpu_1m_percent": 79, "cpu_5m_percent": 80, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 79, "cpu_5m_percent": 80, "top_process": "SNMP ENGINE"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:29:45.824137Z", "memory_used_percent": 96, "memory_free_mb": 98, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 98, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:11:45.826494Z", "memory_used_percent": 87, "memory_free_mb": 373, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 373, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:04:45.827080Z", "process": "telemetry", "pid": 2446, "crash_count_24h": 17, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "telemetry", "pid": 2446, "crash_count_24h": 17, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T21:05:45.828668Z", "process": "crypto", "pid": 3970, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 3970, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:08:45.823923Z", "cpu_5s_percent": 100, "cpu_1m_percent": 84, "cpu_5m_percent": 67, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 84, "cpu_5m_percent": 67, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:27:45.825512Z", "memory_used_percent": 96, "memory_free_mb": 112, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 112, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:37:45.828886Z", "process": "bgp", "pid": 3484, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "bgp", "pid": 3484, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:23:45.826793Z", "process": "iosd", "pid": 163, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 163, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:41:45.825394Z", "memory_used_percent": 94, "memory_free_mb": 298, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 298, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:40:45.824154Z", "memory_used_percent": 84, "memory_free_mb": 475, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 475, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:08:45.826237Z", "memory_used_percent": 96, "memory_free_mb": 94, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 94, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:21:45.823080Z", "cpu_5s_percent": 97, "cpu_1m_percent": 80, "cpu_5m_percent": 88, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 80, "cpu_5m_percent": 88, "top_process": "Crypto IKEv2"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:10:45.822852Z", "cpu_5s_percent": 94, "cpu_1m_percent": 81, "cpu_5m_percent": 75, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 81, "cpu_5m_percent": 75, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:09:45.823614Z", "cpu_5s_percent": 87, "cpu_1m_percent": 81, "cpu_5m_percent": 93, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 81, "cpu_5m_percent": 93, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:02:45.823676Z", "cpu_5s_percent": 99, "cpu_1m_percent": 82, "cpu_5m_percent": 83, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 82, "cpu_5m_percent": 83, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:56:45.824407Z", "memory_used_percent": 81, "memory_free_mb": 241, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 241, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:45:45.828270Z", "process": "iosd", "pid": 1717, "crash_count_24h": 22, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 1717, "crash_count_24h": 22, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:55:45.827588Z", "process": "iosd", "pid": 2615, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "iosd", "pid": 2615, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:18:45.829370Z", "process": "telemetry", "pid": 4125, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 4125, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:36:45.829640Z", "process": "telemetry", "pid": 4849, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 4849, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:56:45.828512Z", "process": "telemetry", "pid": 4035, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 4035, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:03:45.822729Z", "cpu_5s_percent": 87, "cpu_1m_percent": 79, "cpu_5m_percent": 74, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 79, "cpu_5m_percent": 74, "top_process": "Crypto IKEv2"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:13:45.826598Z", "memory_used_percent": 98, "memory_free_mb": 303, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 303, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:15:45.823716Z", "cpu_5s_percent": 98, "cpu_1m_percent": 96, "cpu_5m_percent": 90, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 96, "cpu_5m_percent": 90, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:46:45.822620Z", "cpu_5s_percent": 96, "cpu_1m_percent": 76, "cpu_5m_percent": 72, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 76, "cpu_5m_percent": 72, "top_process": "ARP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T11:58:45.824366Z", "memory_used_percent": 90, "memory_free_mb": 152, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 152, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:14:45.828230Z", "process": "iosd", "pid": 2263, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 2263, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:24:45.829499Z", "process": "ospf", "pid": 3135, "crash_count_24h": 18, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3135, "crash_count_24h": 18, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:37:45.825035Z", "memory_used_percent": 98, "memory_free_mb": 118, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 118, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:43:45.822979Z", "cpu_5s_percent": 97, "cpu_1m_percent": 99, "cpu_5m_percent": 69, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 99, "cpu_5m_percent": 69, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:23:45.828585Z", "process": "snmpd", "pid": 4123, "crash_count_24h": 18, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 4123, "crash_count_24h": 18, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:34:45.822797Z", "cpu_5s_percent": 88, "cpu_1m_percent": 88, "cpu_5m_percent": 79, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 88, "cpu_5m_percent": 79, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:49:45.828439Z", "process": "ospf", "pid": 2852, "crash_count_24h": 4, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "ospf", "pid": 2852, "crash_count_24h": 4, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:01:45.821687Z", "cpu_5s_percent": 92, "cpu_1m_percent": 92, "cpu_5m_percent": 66, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 92, "cpu_5m_percent": 66, "top_process": "CEF RP"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:25:45.828494Z", "process": "telemetry", "pid": 4250, "crash_count_24h": 3, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 4250, "crash_count_24h": 3, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:16:45.826809Z", "process": "crypto", "pid": 4299, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 4299, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:47:45.825967Z", "memory_used_percent": 80, "memory_free_mb": 276, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 276, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:30:45.823097Z", "cpu_5s_percent": 88, "cpu_1m_percent": 98, "cpu_5m_percent": 67, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 98, "cpu_5m_percent": 67, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:01:45.827465Z", "process": "telemetry", "pid": 761, "crash_count_24h": 4, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 761, "crash_count_24h": 4, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:51:45.821827Z", "cpu_5s_percent": 100, "cpu_1m_percent": 91, "cpu_5m_percent": 91, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 91, "cpu_5m_percent": 91, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:46:45.821867Z", "cpu_5s_percent": 96, "cpu_1m_percent": 92, "cpu_5m_percent": 75, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 92, "cpu_5m_percent": 75, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:59:45.829689Z", "process": "iosd", "pid": 1690, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "iosd", "pid": 1690, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:22:45.829630Z", "process": "netconf", "pid": 959, "crash_count_24h": 20, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 959, "crash_count_24h": 20, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:41:45.826978Z", "process": "crypto", "pid": 2259, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "crypto", "pid": 2259, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:16:45.823173Z", "cpu_5s_percent": 89, "cpu_1m_percent": 97, "cpu_5m_percent": 95, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 97, "cpu_5m_percent": 95, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:12:45.827126Z", "process": "netconf", "pid": 873, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 873, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:19:45.827683Z", "process": "ospf", "pid": 3968, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "ospf", "pid": 3968, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:44:45.824892Z", "memory_used_percent": 83, "memory_free_mb": 486, "memory_total_mb": 4096, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 486, "memory_total_mb": 4096, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:20:45.822522Z", "cpu_5s_percent": 97, "cpu_1m_percent": 98, "cpu_5m_percent": 82, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 98, "cpu_5m_percent": 82, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:49:45.828875Z", "process": "crypto", "pid": 3243, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 3243, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:20:45.826534Z", "memory_used_percent": 89, "memory_free_mb": 425, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 425, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:04:45.828794Z", "process": "bgp", "pid": 2358, "crash_count_24h": 19, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 2358, "crash_count_24h": 19, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:39:45.824755Z", "memory_used_percent": 94, "memory_free_mb": 411, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 411, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:49:45.822187Z", "cpu_5s_percent": 100, "cpu_1m_percent": 95, "cpu_5m_percent": 90, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 95, "cpu_5m_percent": 90, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:48:45.828657Z", "process": "bgp", "pid": 1541, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 1541, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:49:45.826246Z", "memory_used_percent": 85, "memory_free_mb": 404, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 404, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:19:45.825930Z", "memory_used_percent": 87, "memory_free_mb": 176, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 176, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:40:45.825230Z", "memory_used_percent": 86, "memory_free_mb": 396, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 396, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:55:45.826669Z", "memory_used_percent": 85, "memory_free_mb": 425, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 425, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:24:45.828781Z", "process": "snmpd", "pid": 2244, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 2244, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:14:45.827613Z", "process": "telemetry", "pid": 3852, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 3852, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:42:45.825220Z", "memory_used_percent": 83, "memory_free_mb": 249, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 249, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:18:45.822544Z", "cpu_5s_percent": 94, "cpu_1m_percent": 96, "cpu_5m_percent": 82, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 96, "cpu_5m_percent": 82, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:10:45.823641Z", "cpu_5s_percent": 95, "cpu_1m_percent": 89, "cpu_5m_percent": 65, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 89, "cpu_5m_percent": 65, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:35:45.826897Z", "process": "ospf", "pid": 2733, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 2733, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:19:45.821978Z", "cpu_5s_percent": 85, "cpu_1m_percent": 96, "cpu_5m_percent": 94, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 96, "cpu_5m_percent": 94, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:46:45.827530Z", "process": "snmpd", "pid": 1354, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "snmpd", "pid": 1354, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:35:45.822711Z", "cpu_5s_percent": 85, "cpu_1m_percent": 91, "cpu_5m_percent": 89, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 91, "cpu_5m_percent": 89, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:49:45.823270Z", "cpu_5s_percent": 87, "cpu_1m_percent": 98, "cpu_5m_percent": 89, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 98, "cpu_5m_percent": 89, "top_process": "Crypto IKEv2"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:28:45.828210Z", "process": "ospf", "pid": 3246, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 3246, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:29:45.825249Z", "memory_used_percent": 89, "memory_free_mb": 390, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 390, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:56:45.828353Z", "process": "iosd", "pid": 4563, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "iosd", "pid": 4563, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:23:45.829573Z", "process": "netconf", "pid": 1883, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 1883, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:40:45.822847Z", "cpu_5s_percent": 90, "cpu_1m_percent": 82, "cpu_5m_percent": 92, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 82, "cpu_5m_percent": 92, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:05:45.828203Z", "process": "iosd", "pid": 2692, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 2692, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:15:45.825797Z", "memory_used_percent": 84, "memory_free_mb": 316, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 316, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:13:45.825826Z", "memory_used_percent": 92, "memory_free_mb": 432, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 432, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:35:45.828361Z", "process": "iosd", "pid": 201, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "iosd", "pid": 201, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:46:45.825077Z", "memory_used_percent": 95, "memory_free_mb": 250, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 250, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:26:45.822858Z", "cpu_5s_percent": 87, "cpu_1m_percent": 91, "cpu_5m_percent": 95, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 91, "cpu_5m_percent": 95, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:23:45.824203Z", "memory_used_percent": 84, "memory_free_mb": 369, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 369, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:03:45.827482Z", "process": "netconf", "pid": 987, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 987, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:53:45.823484Z", "cpu_5s_percent": 88, "cpu_1m_percent": 88, "cpu_5m_percent": 91, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 88, "cpu_5m_percent": 91, "top_process": "IP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:26:45.822044Z", "cpu_5s_percent": 85, "cpu_1m_percent": 97, "cpu_5m_percent": 95, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 97, "cpu_5m_percent": 95, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:26:45.827619Z", "process": "iosd", "pid": 508, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "iosd", "pid": 508, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:31:45.829608Z", "process": "snmpd", "pid": 1233, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 1233, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:27:45.826947Z", "process": "iosd", "pid": 425, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 425, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:41:45.822154Z", "cpu_5s_percent": 93, "cpu_1m_percent": 88, "cpu_5m_percent": 75, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 88, "cpu_5m_percent": 75, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:03:45.822003Z", "cpu_5s_percent": 86, "cpu_1m_percent": 99, "cpu_5m_percent": 76, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 99, "cpu_5m_percent": 76, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:36:45.829478Z", "process": "snmpd", "pid": 1490, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 1490, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T11:45:45.824932Z", "memory_used_percent": 81, "memory_free_mb": 244, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 244, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:57:45.821879Z", "cpu_5s_percent": 100, "cpu_1m_percent": 84, "cpu_5m_percent": 65, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 84, "cpu_5m_percent": 65, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:08:45.829305Z", "process": "crypto", "pid": 1600, "crash_count_24h": 23, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1600, "crash_count_24h": 23, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:22:45.826693Z", "memory_used_percent": 88, "memory_free_mb": 80, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 80, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:01:45.823021Z", "cpu_5s_percent": 91, "cpu_1m_percent": 77, "cpu_5m_percent": 78, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 77, "cpu_5m_percent": 78, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:08:45.828674Z", "process": "bgp", "pid": 2727, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "bgp", "pid": 2727, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:14:45.822383Z", "cpu_5s_percent": 90, "cpu_1m_percent": 90, "cpu_5m_percent": 82, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 90, "cpu_5m_percent": 82, "top_process": "Crypto IKEv2"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:47:45.825662Z", "memory_used_percent": 88, "memory_free_mb": 275, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 275, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:14:45.829289Z", "process": "netconf", "pid": 3710, "crash_count_24h": 6, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 3710, "crash_count_24h": 6, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T16:08:45.828099Z", "process": "bgp", "pid": 3248, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "bgp", "pid": 3248, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:25:45.824765Z", "memory_used_percent": 92, "memory_free_mb": 348, "memory_total_mb": 1024, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 348, "memory_total_mb": 1024, "top_consumer": "ospf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:27:45.824236Z", "memory_used_percent": 81, "memory_free_mb": 383, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 383, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:00:45.825287Z", "memory_used_percent": 92, "memory_free_mb": 152, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 152, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T19:25:45.825365Z", "memory_used_percent": 95, "memory_free_mb": 428, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 428, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:28:45.828329Z", "process": "crypto", "pid": 3454, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 3454, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:04:45.826499Z", "memory_used_percent": 85, "memory_free_mb": 256, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 256, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:21:45.822863Z", "cpu_5s_percent": 97, "cpu_1m_percent": 83, "cpu_5m_percent": 71, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 83, "cpu_5m_percent": 71, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:13:45.825939Z", "memory_used_percent": 89, "memory_free_mb": 274, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 274, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:22:45.825521Z", "memory_used_percent": 99, "memory_free_mb": 204, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 204, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:27:45.828018Z", "process": "telemetry", "pid": 4845, "crash_count_24h": 10, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "telemetry", "pid": 4845, "crash_count_24h": 10, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:02:45.823658Z", "cpu_5s_percent": 88, "cpu_1m_percent": 99, "cpu_5m_percent": 93, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 99, "cpu_5m_percent": 93, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:43:45.828073Z", "process": "ospf", "pid": 244, "crash_count_24h": 14, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "ospf", "pid": 244, "crash_count_24h": 14, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:57:45.827672Z", "process": "bgp", "pid": 4370, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 4370, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:19:45.823472Z", "cpu_5s_percent": 100, "cpu_1m_percent": 78, "cpu_5m_percent": 76, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 78, "cpu_5m_percent": 76, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T21:12:45.828960Z", "process": "iosd", "pid": 2308, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 2308, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:44:45.825494Z", "memory_used_percent": 93, "memory_free_mb": 223, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 223, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:06:45.823340Z", "cpu_5s_percent": 99, "cpu_1m_percent": 98, "cpu_5m_percent": 86, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 98, "cpu_5m_percent": 86, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:37:45.825709Z", "memory_used_percent": 90, "memory_free_mb": 409, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 409, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T11:50:45.826173Z", "memory_used_percent": 81, "memory_free_mb": 375, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 375, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:52:45.829579Z", "process": "crypto", "pid": 1401, "crash_count_24h": 4, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1401, "crash_count_24h": 4, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:18:45.824539Z", "memory_used_percent": 87, "memory_free_mb": 423, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 423, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:45:45.823957Z", "cpu_5s_percent": 87, "cpu_1m_percent": 94, "cpu_5m_percent": 74, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 94, "cpu_5m_percent": 74, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:17:45.826571Z", "memory_used_percent": 83, "memory_free_mb": 385, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 385, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:25:45.827735Z", "process": "iosd", "pid": 156, "crash_count_24h": 24, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 156, "crash_count_24h": 24, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:38:45.825779Z", "memory_used_percent": 90, "memory_free_mb": 178, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 178, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:21:45.828914Z", "process": "crypto", "pid": 2123, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "crypto", "pid": 2123, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:27:45.826183Z", "memory_used_percent": 93, "memory_free_mb": 178, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 178, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T11:35:45.823653Z", "cpu_5s_percent": 94, "cpu_1m_percent": 94, "cpu_5m_percent": 77, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 94, "cpu_5m_percent": 77, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:24:45.824818Z", "memory_used_percent": 93, "memory_free_mb": 119, "memory_total_mb": 4096, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 119, "memory_total_mb": 4096, "top_consumer": "ospf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:08:45.823055Z", "cpu_5s_percent": 91, "cpu_1m_percent": 79, "cpu_5m_percent": 70, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 79, "cpu_5m_percent": 70, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:03:45.828593Z", "process": "netconf", "pid": 2745, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2745, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:39:45.824668Z", "memory_used_percent": 88, "memory_free_mb": 115, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 115, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:32:45.828061Z", "process": "snmpd", "pid": 842, "crash_count_24h": 10, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 842, "crash_count_24h": 10, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:05:45.825700Z", "memory_used_percent": 89, "memory_free_mb": 300, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 300, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:02:45.826657Z", "memory_used_percent": 81, "memory_free_mb": 423, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 423, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:02:45.825503Z", "memory_used_percent": 99, "memory_free_mb": 477, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 477, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:00:45.825466Z", "memory_used_percent": 88, "memory_free_mb": 432, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 432, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:11:45.826845Z", "process": "bgp", "pid": 674, "crash_count_24h": 6, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 674, "crash_count_24h": 6, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:36:45.828296Z", "process": "bgp", "pid": 4677, "crash_count_24h": 3, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 4677, "crash_count_24h": 3, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:15:45.824460Z", "memory_used_percent": 93, "memory_free_mb": 84, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 84, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:00:45.828606Z", "process": "netconf", "pid": 4412, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4412, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:07:45.825729Z", "memory_used_percent": 82, "memory_free_mb": 270, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 270, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:07:45.823848Z", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 74, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 74, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:58:45.824230Z", "memory_used_percent": 87, "memory_free_mb": 365, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 365, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:10:45.827762Z", "process": "iosd", "pid": 3567, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "iosd", "pid": 3567, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:55:45.826682Z", "memory_used_percent": 85, "memory_free_mb": 118, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 118, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:05:45.821941Z", "cpu_5s_percent": 98, "cpu_1m_percent": 85, "cpu_5m_percent": 92, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 85, "cpu_5m_percent": 92, "top_process": "SNMP ENGINE"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:17:45.825072Z", "memory_used_percent": 94, "memory_free_mb": 162, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 162, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:10:45.826078Z", "memory_used_percent": 96, "memory_free_mb": 207, "memory_total_mb": 8192, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 207, "memory_total_mb": 8192, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:34:45.822535Z", "cpu_5s_percent": 98, "cpu_1m_percent": 82, "cpu_5m_percent": 69, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 82, "cpu_5m_percent": 69, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:13:45.825590Z", "memory_used_percent": 91, "memory_free_mb": 441, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 441, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T15:49:45.821586Z", "cpu_5s_percent": 90, "cpu_1m_percent": 99, "cpu_5m_percent": 91, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 99, "cpu_5m_percent": 91, "top_process": "SSH Process"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:55:45.824828Z", "memory_used_percent": 96, "memory_free_mb": 125, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 125, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T13:40:45.822462Z", "cpu_5s_percent": 93, "cpu_1m_percent": 85, "cpu_5m_percent": 82, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 85, "cpu_5m_percent": 82, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T15:09:45.828035Z", "process": "telemetry", "pid": 3361, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 3361, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:18:45.822747Z", "cpu_5s_percent": 93, "cpu_1m_percent": 90, "cpu_5m_percent": 71, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 90, "cpu_5m_percent": 71, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:06:45.826419Z", "memory_used_percent": 84, "memory_free_mb": 462, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 462, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:26:45.823497Z", "cpu_5s_percent": 93, "cpu_1m_percent": 89, "cpu_5m_percent": 69, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 89, "cpu_5m_percent": 69, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:59:45.828565Z", "process": "netconf", "pid": 1557, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "netconf", "pid": 1557, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:29:45.826358Z", "memory_used_percent": 80, "memory_free_mb": 243, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 243, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:31:45.825156Z", "memory_used_percent": 81, "memory_free_mb": 495, "memory_total_mb": 8192, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 495, "memory_total_mb": 8192, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:42:45.824681Z", "memory_used_percent": 88, "memory_free_mb": 320, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 320, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T21:26:45.823137Z", "cpu_5s_percent": 88, "cpu_1m_percent": 83, "cpu_5m_percent": 75, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 83, "cpu_5m_percent": 75, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:13:45.827595Z", "process": "ospf", "pid": 3496, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "ospf", "pid": 3496, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:10:45.826067Z", "memory_used_percent": 89, "memory_free_mb": 497, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 497, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T18:42:45.822087Z", "cpu_5s_percent": 96, "cpu_1m_percent": 94, "cpu_5m_percent": 71, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 94, "cpu_5m_percent": 71, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:36:45.821990Z", "cpu_5s_percent": 93, "cpu_1m_percent": 91, "cpu_5m_percent": 82, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 91, "cpu_5m_percent": 82, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T21:16:45.823208Z", "cpu_5s_percent": 98, "cpu_1m_percent": 85, "cpu_5m_percent": 74, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 85, "cpu_5m_percent": 74, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:01:45.822612Z", "cpu_5s_percent": 100, "cpu_1m_percent": 95, "cpu_5m_percent": 67, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 95, "cpu_5m_percent": 67, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:04:45.824508Z", "memory_used_percent": 84, "memory_free_mb": 130, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 130, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:16:45.828160Z", "process": "ospf", "pid": 3807, "crash_count_24h": 19, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "ospf", "pid": 3807, "crash_count_24h": 19, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:24:45.828081Z", "process": "crypto", "pid": 1961, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1961, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T20:46:45.828611Z", "process": "telemetry", "pid": 3086, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "telemetry", "pid": 3086, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:50:45.827974Z", "process": "iosd", "pid": 4741, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4741, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:17:45.826291Z", "memory_used_percent": 80, "memory_free_mb": 116, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 116, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:27:45.825047Z", "memory_used_percent": 87, "memory_free_mb": 149, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 149, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:39:45.824612Z", "memory_used_percent": 92, "memory_free_mb": 176, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 176, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:08:45.827823Z", "process": "netconf", "pid": 3861, "crash_count_24h": 4, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "netconf", "pid": 3861, "crash_count_24h": 4, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T17:46:45.827829Z", "process": "ospf", "pid": 1066, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "ospf", "pid": 1066, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:29:45.827502Z", "process": "telemetry", "pid": 4696, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 4696, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T12:33:45.829406Z", "process": "bgp", "pid": 439, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "bgp", "pid": 439, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T13:29:45.821785Z", "cpu_5s_percent": 98, "cpu_1m_percent": 80, "cpu_5m_percent": 87, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 80, "cpu_5m_percent": 87, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:47:45.828633Z", "process": "netconf", "pid": 3390, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 3390, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T12:08:45.822639Z", "cpu_5s_percent": 95, "cpu_1m_percent": 84, "cpu_5m_percent": 90, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 84, "cpu_5m_percent": 90, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T11:40:45.827032Z", "process": "bgp", "pid": 3080, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "bgp", "pid": 3080, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T19:34:45.824305Z", "memory_used_percent": 94, "memory_free_mb": 197, "memory_total_mb": 4096, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 197, "memory_total_mb": 4096, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T17:32:45.826644Z", "memory_used_percent": 89, "memory_free_mb": 173, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 173, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T14:19:45.828055Z", "process": "iosd", "pid": 590, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "iosd", "pid": 590, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T18:15:45.829715Z", "process": "snmpd", "pid": 1647, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 1647, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["snmp-server enable traps syslog", "logging host 10.0.0.10", "logging trap warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T16:50:45.824004Z", "cpu_5s_percent": 85, "cpu_1m_percent": 99, "cpu_5m_percent": 79, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 99, "cpu_5m_percent": 79, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-06T20:40:45.824401Z", "memory_used_percent": 94, "memory_free_mb": 425, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 425, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-06T14:10:45.824124Z", "memory_used_percent": 98, "memory_free_mb": 355, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 355, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}