{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:53:09.813186Z", "cpu_5s_percent": 86, "cpu_1m_percent": 89, "cpu_5m_percent": 90, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 89, "cpu_5m_percent": 90, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:54:09.821493Z", "process": "bgp", "pid": 1356, "crash_count_24h": 4, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "bgp", "pid": 1356, "crash_count_24h": 4, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:26:09.819102Z", "memory_used_percent": 94, "memory_free_mb": 127, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 127, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:18:09.813572Z", "cpu_5s_percent": 88, "cpu_1m_percent": 88, "cpu_5m_percent": 69, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 88, "cpu_5m_percent": 69, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:13:09.820868Z", "process": "netconf", "pid": 1520, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "netconf", "pid": 1520, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:07:09.814100Z", "cpu_5s_percent": 98, "cpu_1m_percent": 87, "cpu_5m_percent": 70, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 87, "cpu_5m_percent": 70, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:41:09.824177Z", "process": "ospf", "pid": 935, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "ospf", "pid": 935, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:30:09.823340Z", "process": "ospf", "pid": 3394, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 3394, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:02:09.817464Z", "memory_used_percent": 80, "memory_free_mb": 104, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 104, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:34:09.813302Z", "cpu_5s_percent": 95, "cpu_1m_percent": 93, "cpu_5m_percent": 77, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 93, "cpu_5m_percent": 77, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:28:09.817008Z", "memory_used_percent": 98, "memory_free_mb": 187, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 187, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:37:09.820795Z", "process": "snmpd", "pid": 2512, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 2512, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:54:09.814964Z", "cpu_5s_percent": 94, "cpu_1m_percent": 80, "cpu_5m_percent": 81, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 80, "cpu_5m_percent": 81, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:28:09.819840Z", "memory_used_percent": 96, "memory_free_mb": 181, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 181, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:54:09.815371Z", "cpu_5s_percent": 91, "cpu_1m_percent": 92, "cpu_5m_percent": 92, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 92, "cpu_5m_percent": 92, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:00:09.821565Z", "process": "ospf", "pid": 1308, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "ospf", "pid": 1308, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:13:09.821988Z", "process": "netconf", "pid": 4740, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4740, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:18:09.814705Z", "cpu_5s_percent": 91, "cpu_1m_percent": 89, "cpu_5m_percent": 90, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 89, "cpu_5m_percent": 90, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:19:09.817088Z", "memory_used_percent": 90, "memory_free_mb": 399, "memory_total_mb": 4096, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 399, "memory_total_mb": 4096, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:59:09.822184Z", "process": "snmpd", "pid": 4488, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "snmpd", "pid": 4488, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:38:09.821796Z", "process": "netconf", "pid": 1174, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "netconf", "pid": 1174, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:40:09.819054Z", "memory_used_percent": 82, "memory_free_mb": 244, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 244, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:34:09.819381Z", "memory_used_percent": 98, "memory_free_mb": 274, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 274, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:16:09.822613Z", "process": "ospf", "pid": 1501, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "ospf", "pid": 1501, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:01:09.823407Z", "process": "ospf", "pid": 2907, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 2907, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:46:09.821344Z", "process": "crypto", "pid": 3771, "crash_count_24h": 4, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "crypto", "pid": 3771, "crash_count_24h": 4, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:58:09.822272Z", "process": "snmpd", "pid": 3447, "crash_count_24h": 3, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 3447, "crash_count_24h": 3, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:56:09.822174Z", "process": "telemetry", "pid": 1137, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 1137, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:02:09.819951Z", "memory_used_percent": 88, "memory_free_mb": 491, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 491, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:07:09.814313Z", "cpu_5s_percent": 93, "cpu_1m_percent": 98, "cpu_5m_percent": 84, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 98, "cpu_5m_percent": 84, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:23:09.815299Z", "cpu_5s_percent": 93, "cpu_1m_percent": 84, "cpu_5m_percent": 67, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 84, "cpu_5m_percent": 67, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:08:09.823062Z", "process": "netconf", "pid": 2208, "crash_count_24h": 6, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2208, "crash_count_24h": 6, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:55:09.823292Z", "process": "crypto", "pid": 1058, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 1058, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:49:09.824048Z", "process": "snmpd", "pid": 4297, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 4297, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T04:46:09.820565Z", "process": "ospf", "pid": 1449, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "ospf", "pid": 1449, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:41:09.821838Z", "process": "snmpd", "pid": 4579, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4579, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:37:09.815466Z", "cpu_5s_percent": 90, "cpu_1m_percent": 99, "cpu_5m_percent": 87, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 99, "cpu_5m_percent": 87, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:19:09.815682Z", "cpu_5s_percent": 98, "cpu_1m_percent": 85, "cpu_5m_percent": 95, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 85, "cpu_5m_percent": 95, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:30:09.814789Z", "cpu_5s_percent": 86, "cpu_1m_percent": 95, "cpu_5m_percent": 86, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 95, "cpu_5m_percent": 86, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:00:09.818754Z", "memory_used_percent": 85, "memory_free_mb": 449, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 449, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:45:09.821240Z", "process": "crypto", "pid": 4957, "crash_count_24h": 25, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 4957, "crash_count_24h": 25, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:07:09.818992Z", "memory_used_percent": 86, "memory_free_mb": 290, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 290, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:42:09.813451Z", "cpu_5s_percent": 99, "cpu_1m_percent": 85, "cpu_5m_percent": 91, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 85, "cpu_5m_percent": 91, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:35:09.823422Z", "process": "bgp", "pid": 971, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 971, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:48:09.813970Z", "cpu_5s_percent": 87, "cpu_1m_percent": 87, "cpu_5m_percent": 81, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 87, "cpu_5m_percent": 81, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T04:50:09.813004Z", "cpu_5s_percent": 92, "cpu_1m_percent": 84, "cpu_5m_percent": 67, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 84, "cpu_5m_percent": 67, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:46:09.822726Z", "process": "netconf", "pid": 2337, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2337, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:33:09.812659Z", "cpu_5s_percent": 85, "cpu_1m_percent": 96, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 96, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:54:09.816569Z", "memory_used_percent": 99, "memory_free_mb": 490, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 490, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:10:09.815226Z", "cpu_5s_percent": 96, "cpu_1m_percent": 97, "cpu_5m_percent": 81, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 97, "cpu_5m_percent": 81, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:58:09.815142Z", "cpu_5s_percent": 100, "cpu_1m_percent": 95, "cpu_5m_percent": 90, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 95, "cpu_5m_percent": 90, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:24:09.814290Z", "cpu_5s_percent": 87, "cpu_1m_percent": 97, "cpu_5m_percent": 85, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 97, "cpu_5m_percent": 85, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:22:09.822572Z", "process": "bgp", "pid": 615, "crash_count_24h": 3, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "bgp", "pid": 615, "crash_count_24h": 3, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:38:09.819621Z", "memory_used_percent": 87, "memory_free_mb": 450, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 450, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:42:09.814715Z", "cpu_5s_percent": 92, "cpu_1m_percent": 85, "cpu_5m_percent": 76, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 85, "cpu_5m_percent": 76, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:25:09.817064Z", "memory_used_percent": 81, "memory_free_mb": 295, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 295, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:45:09.821250Z", "process": "iosd", "pid": 3744, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3744, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:42:09.814216Z", "cpu_5s_percent": 87, "cpu_1m_percent": 83, "cpu_5m_percent": 86, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 83, "cpu_5m_percent": 86, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:11:09.822736Z", "process": "iosd", "pid": 2119, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "iosd", "pid": 2119, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:24:09.817529Z", "memory_used_percent": 91, "memory_free_mb": 347, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 347, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:42:09.823523Z", "process": "iosd", "pid": 3586, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3586, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:20:09.813719Z", "cpu_5s_percent": 99, "cpu_1m_percent": 95, "cpu_5m_percent": 77, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 95, "cpu_5m_percent": 77, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:51:09.820601Z", "process": "iosd", "pid": 165, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "iosd", "pid": 165, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:50:09.818361Z", "memory_used_percent": 81, "memory_free_mb": 256, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 256, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:55:09.823584Z", "process": "iosd", "pid": 1999, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 1999, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:02:09.813846Z", "cpu_5s_percent": 96, "cpu_1m_percent": 82, "cpu_5m_percent": 89, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 82, "cpu_5m_percent": 89, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:30:09.814131Z", "cpu_5s_percent": 93, "cpu_1m_percent": 86, "cpu_5m_percent": 65, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 86, "cpu_5m_percent": 65, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:08:09.816784Z", "memory_used_percent": 83, "memory_free_mb": 433, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 433, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:38:09.823190Z", "process": "crypto", "pid": 1474, "crash_count_24h": 17, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1474, "crash_count_24h": 17, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:28:09.813836Z", "cpu_5s_percent": 86, "cpu_1m_percent": 85, "cpu_5m_percent": 85, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 85, "cpu_5m_percent": 85, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:41:09.819831Z", "memory_used_percent": 87, "memory_free_mb": 363, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 363, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:28:09.820995Z", "process": "telemetry", "pid": 1859, "crash_count_24h": 18, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "telemetry", "pid": 1859, "crash_count_24h": 18, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:25:09.816763Z", "memory_used_percent": 86, "memory_free_mb": 430, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 430, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:55:09.813749Z", "cpu_5s_percent": 100, "cpu_1m_percent": 97, "cpu_5m_percent": 76, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 97, "cpu_5m_percent": 76, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:56:09.816547Z", "memory_used_percent": 81, "memory_free_mb": 424, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 424, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:41:09.814363Z", "cpu_5s_percent": 85, "cpu_1m_percent": 91, "cpu_5m_percent": 69, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 91, "cpu_5m_percent": 69, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:35:09.821869Z", "process": "iosd", "pid": 4457, "crash_count_24h": 12, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4457, "crash_count_24h": 12, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:01:09.816535Z", "memory_used_percent": 92, "memory_free_mb": 210, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 210, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:54:09.817784Z", "memory_used_percent": 80, "memory_free_mb": 154, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 154, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:16:09.813381Z", "cpu_5s_percent": 100, "cpu_1m_percent": 85, "cpu_5m_percent": 70, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 85, "cpu_5m_percent": 70, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:17:09.817175Z", "memory_used_percent": 82, "memory_free_mb": 483, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 483, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:00:09.815539Z", "cpu_5s_percent": 87, "cpu_1m_percent": 96, "cpu_5m_percent": 82, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 96, "cpu_5m_percent": 82, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:49:09.822023Z", "process": "snmpd", "pid": 3413, "crash_count_24h": 10, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3413, "crash_count_24h": 10, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:55:09.822002Z", "process": "bgp", "pid": 756, "crash_count_24h": 15, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "bgp", "pid": 756, "crash_count_24h": 15, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:43:09.823106Z", "process": "iosd", "pid": 3908, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3908, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:36:09.822664Z", "process": "iosd", "pid": 3973, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "iosd", "pid": 3973, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:41:09.821644Z", "process": "iosd", "pid": 3513, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "iosd", "pid": 3513, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:22:09.821705Z", "process": "bgp", "pid": 1893, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "bgp", "pid": 1893, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:49:09.819063Z", "memory_used_percent": 84, "memory_free_mb": 171, "memory_total_mb": 4096, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 171, "memory_total_mb": 4096, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:58:09.822632Z", "process": "iosd", "pid": 2416, "crash_count_24h": 20, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "iosd", "pid": 2416, "crash_count_24h": 20, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:10:09.821088Z", "process": "ospf", "pid": 205, "crash_count_24h": 20, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "ospf", "pid": 205, "crash_count_24h": 20, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:55:09.813371Z", "cpu_5s_percent": 91, "cpu_1m_percent": 97, "cpu_5m_percent": 69, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 97, "cpu_5m_percent": 69, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:36:09.822315Z", "process": "bgp", "pid": 1170, "crash_count_24h": 13, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 1170, "crash_count_24h": 13, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:27:09.814151Z", "cpu_5s_percent": 86, "cpu_1m_percent": 84, "cpu_5m_percent": 68, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 84, "cpu_5m_percent": 68, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:03:09.813110Z", "cpu_5s_percent": 88, "cpu_1m_percent": 87, "cpu_5m_percent": 85, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 87, "cpu_5m_percent": 85, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:52:09.812179Z", "cpu_5s_percent": 89, "cpu_1m_percent": 80, "cpu_5m_percent": 84, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 80, "cpu_5m_percent": 84, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:32:09.816974Z", "memory_used_percent": 98, "memory_free_mb": 120, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 120, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:16:09.814353Z", "cpu_5s_percent": 99, "cpu_1m_percent": 75, "cpu_5m_percent": 66, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 75, "cpu_5m_percent": 66, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:55:09.814490Z", "cpu_5s_percent": 100, "cpu_1m_percent": 78, "cpu_5m_percent": 79, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 78, "cpu_5m_percent": 79, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:29:09.815754Z", "cpu_5s_percent": 91, "cpu_1m_percent": 75, "cpu_5m_percent": 75, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 75, "cpu_5m_percent": 75, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:39:09.823614Z", "process": "netconf", "pid": 3080, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "netconf", "pid": 3080, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:00:09.818488Z", "memory_used_percent": 81, "memory_free_mb": 186, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 186, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:54:09.815807Z", "cpu_5s_percent": 98, "cpu_1m_percent": 90, "cpu_5m_percent": 85, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 90, "cpu_5m_percent": 85, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:14:09.813602Z", "cpu_5s_percent": 91, "cpu_1m_percent": 82, "cpu_5m_percent": 87, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 82, "cpu_5m_percent": 87, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:55:09.816075Z", "cpu_5s_percent": 91, "cpu_1m_percent": 81, "cpu_5m_percent": 75, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 81, "cpu_5m_percent": 75, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:25:09.822013Z", "process": "ospf", "pid": 3815, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3815, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:53:09.815529Z", "cpu_5s_percent": 96, "cpu_1m_percent": 93, "cpu_5m_percent": 67, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 93, "cpu_5m_percent": 67, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:16:09.813959Z", "cpu_5s_percent": 89, "cpu_1m_percent": 76, "cpu_5m_percent": 71, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 76, "cpu_5m_percent": 71, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:45:09.818918Z", "memory_used_percent": 85, "memory_free_mb": 364, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 364, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:37:09.818383Z", "memory_used_percent": 98, "memory_free_mb": 83, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 83, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:34:09.818785Z", "memory_used_percent": 92, "memory_free_mb": 452, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 452, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:38:09.816524Z", "memory_used_percent": 81, "memory_free_mb": 389, "memory_total_mb": 2048, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 389, "memory_total_mb": 2048, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:52:09.812373Z", "cpu_5s_percent": 98, "cpu_1m_percent": 77, "cpu_5m_percent": 86, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 77, "cpu_5m_percent": 86, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:40:09.813079Z", "cpu_5s_percent": 100, "cpu_1m_percent": 76, "cpu_5m_percent": 85, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 76, "cpu_5m_percent": 85, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:25:09.823330Z", "process": "telemetry", "pid": 4762, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 4762, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:43:09.818629Z", "memory_used_percent": 87, "memory_free_mb": 493, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 493, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:22:09.819391Z", "memory_used_percent": 85, "memory_free_mb": 128, "memory_total_mb": 1024, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 128, "memory_total_mb": 1024, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:30:09.817837Z", "memory_used_percent": 91, "memory_free_mb": 117, "memory_total_mb": 8192, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 117, "memory_total_mb": 8192, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:28:09.822163Z", "process": "netconf", "pid": 1607, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "netconf", "pid": 1607, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:18:09.819361Z", "memory_used_percent": 92, "memory_free_mb": 223, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 223, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:28:09.815766Z", "cpu_5s_percent": 92, "cpu_1m_percent": 76, "cpu_5m_percent": 93, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 76, "cpu_5m_percent": 93, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:13:09.817769Z", "memory_used_percent": 84, "memory_free_mb": 236, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 236, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:20:09.815498Z", "cpu_5s_percent": 89, "cpu_1m_percent": 77, "cpu_5m_percent": 81, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 77, "cpu_5m_percent": 81, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:59:09.822226Z", "process": "crypto", "pid": 1780, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1780, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:21:09.815026Z", "cpu_5s_percent": 88, "cpu_1m_percent": 80, "cpu_5m_percent": 76, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 80, "cpu_5m_percent": 76, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:42:09.815037Z", "cpu_5s_percent": 99, "cpu_1m_percent": 81, "cpu_5m_percent": 75, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 81, "cpu_5m_percent": 75, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:14:09.822396Z", "process": "telemetry", "pid": 245, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 245, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:49:09.820436Z", "process": "ospf", "pid": 2622, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "ospf", "pid": 2622, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:58:09.813856Z", "cpu_5s_percent": 86, "cpu_1m_percent": 82, "cpu_5m_percent": 94, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 82, "cpu_5m_percent": 94, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:00:09.821200Z", "process": "iosd", "pid": 4856, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "iosd", "pid": 4856, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:46:09.819740Z", "memory_used_percent": 90, "memory_free_mb": 270, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 270, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:07:09.812918Z", "cpu_5s_percent": 88, "cpu_1m_percent": 83, "cpu_5m_percent": 92, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 83, "cpu_5m_percent": 92, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:08:09.818101Z", "memory_used_percent": 89, "memory_free_mb": 369, "memory_total_mb": 4096, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 369, "memory_total_mb": 4096, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:39:09.813699Z", "cpu_5s_percent": 88, "cpu_1m_percent": 92, "cpu_5m_percent": 93, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 92, "cpu_5m_percent": 93, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:36:09.816497Z", "memory_used_percent": 93, "memory_free_mb": 281, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 281, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:54:09.819214Z", "memory_used_percent": 91, "memory_free_mb": 153, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 153, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T04:50:09.823713Z", "process": "ospf", "pid": 3092, "crash_count_24h": 4, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3092, "crash_count_24h": 4, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:26:09.821620Z", "process": "netconf", "pid": 644, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "netconf", "pid": 644, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:03:09.816680Z", "memory_used_percent": 98, "memory_free_mb": 108, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 108, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:18:09.820543Z", "process": "ospf", "pid": 1230, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 1230, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:30:09.819154Z", "memory_used_percent": 91, "memory_free_mb": 339, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 339, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:30:09.813461Z", "cpu_5s_percent": 99, "cpu_1m_percent": 98, "cpu_5m_percent": 65, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 98, "cpu_5m_percent": 65, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:10:09.823356Z", "process": "snmpd", "pid": 2784, "crash_count_24h": 16, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 2784, "crash_count_24h": 16, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:23:09.819754Z", "memory_used_percent": 83, "memory_free_mb": 87, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 87, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:24:09.818195Z", "memory_used_percent": 96, "memory_free_mb": 251, "memory_total_mb": 8192, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 251, "memory_total_mb": 8192, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:05:09.818121Z", "memory_used_percent": 83, "memory_free_mb": 365, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 365, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:12:09.815702Z", "cpu_5s_percent": 100, "cpu_1m_percent": 85, "cpu_5m_percent": 66, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 85, "cpu_5m_percent": 66, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:31:09.824134Z", "process": "telemetry", "pid": 4108, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 4108, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:44:09.816127Z", "cpu_5s_percent": 90, "cpu_1m_percent": 78, "cpu_5m_percent": 95, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 78, "cpu_5m_percent": 95, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:01:09.815798Z", "cpu_5s_percent": 86, "cpu_1m_percent": 76, "cpu_5m_percent": 91, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 76, "cpu_5m_percent": 91, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:29:09.815446Z", "cpu_5s_percent": 88, "cpu_1m_percent": 89, "cpu_5m_percent": 67, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 89, "cpu_5m_percent": 67, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:17:09.813866Z", "cpu_5s_percent": 91, "cpu_1m_percent": 81, "cpu_5m_percent": 86, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 81, "cpu_5m_percent": 86, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:00:09.816003Z", "cpu_5s_percent": 93, "cpu_1m_percent": 82, "cpu_5m_percent": 84, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 82, "cpu_5m_percent": 84, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:16:09.817310Z", "memory_used_percent": 88, "memory_free_mb": 169, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 169, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:49:09.818568Z", "memory_used_percent": 96, "memory_free_mb": 379, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 379, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:24:09.813271Z", "cpu_5s_percent": 99, "cpu_1m_percent": 98, "cpu_5m_percent": 90, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 98, "cpu_5m_percent": 90, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:17:09.817882Z", "memory_used_percent": 99, "memory_free_mb": 377, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 377, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:19:09.813411Z", "cpu_5s_percent": 99, "cpu_1m_percent": 78, "cpu_5m_percent": 89, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 78, "cpu_5m_percent": 89, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:20:09.815983Z", "cpu_5s_percent": 95, "cpu_1m_percent": 89, "cpu_5m_percent": 72, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 89, "cpu_5m_percent": 72, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:33:09.821220Z", "process": "ospf", "pid": 4472, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 4472, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:58:09.817846Z", "memory_used_percent": 82, "memory_free_mb": 267, "memory_total_mb": 4096, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 267, "memory_total_mb": 4096, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:19:09.819765Z", "memory_used_percent": 93, "memory_free_mb": 368, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 368, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:34:09.821388Z", "process": "snmpd", "pid": 1686, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 1686, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:33:09.820315Z", "process": "crypto", "pid": 4176, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "crypto", "pid": 4176, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:44:09.821900Z", "process": "snmpd", "pid": 786, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 786, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:08:09.818928Z", "memory_used_percent": 95, "memory_free_mb": 73, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 73, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:32:09.812907Z", "cpu_5s_percent": 90, "cpu_1m_percent": 87, "cpu_5m_percent": 72, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 87, "cpu_5m_percent": 72, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:20:09.813165Z", "cpu_5s_percent": 87, "cpu_1m_percent": 75, "cpu_5m_percent": 70, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 75, "cpu_5m_percent": 70, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T04:59:09.819144Z", "memory_used_percent": 86, "memory_free_mb": 304, "memory_total_mb": 8192, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 304, "memory_total_mb": 8192, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T04:54:09.822899Z", "process": "netconf", "pid": 447, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 447, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:56:09.821376Z", "process": "netconf", "pid": 604, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "netconf", "pid": 604, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:13:09.820349Z", "process": "iosd", "pid": 3932, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3932, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:11:09.820776Z", "process": "crypto", "pid": 3501, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 3501, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:37:09.821078Z", "process": "snmpd", "pid": 4317, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 4317, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:24:09.818651Z", "memory_used_percent": 93, "memory_free_mb": 315, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 315, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:10:09.815827Z", "cpu_5s_percent": 90, "cpu_1m_percent": 91, "cpu_5m_percent": 74, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 91, "cpu_5m_percent": 74, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:43:09.815257Z", "cpu_5s_percent": 100, "cpu_1m_percent": 87, "cpu_5m_percent": 81, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 87, "cpu_5m_percent": 81, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:37:09.820766Z", "process": "snmpd", "pid": 1119, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 1119, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:31:09.815880Z", "cpu_5s_percent": 91, "cpu_1m_percent": 83, "cpu_5m_percent": 76, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 83, "cpu_5m_percent": 76, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:53:09.821122Z", "process": "crypto", "pid": 2410, "crash_count_24h": 13, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 2410, "crash_count_24h": 13, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:28:09.815331Z", "cpu_5s_percent": 86, "cpu_1m_percent": 81, "cpu_5m_percent": 95, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 81, "cpu_5m_percent": 95, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:43:09.814253Z", "cpu_5s_percent": 91, "cpu_1m_percent": 77, "cpu_5m_percent": 72, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 77, "cpu_5m_percent": 72, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:20:09.813470Z", "cpu_5s_percent": 88, "cpu_1m_percent": 95, "cpu_5m_percent": 88, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 95, "cpu_5m_percent": 88, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:05:09.818162Z", "memory_used_percent": 98, "memory_free_mb": 331, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 331, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:06:09.821588Z", "process": "crypto", "pid": 2657, "crash_count_24h": 12, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 2657, "crash_count_24h": 12, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:06:09.822922Z", "process": "snmpd", "pid": 3087, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 3087, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:26:09.817553Z", "memory_used_percent": 95, "memory_free_mb": 313, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 313, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:32:09.819879Z", "memory_used_percent": 83, "memory_free_mb": 134, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 134, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:46:09.822427Z", "process": "snmpd", "pid": 4331, "crash_count_24h": 10, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4331, "crash_count_24h": 10, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:26:09.817031Z", "memory_used_percent": 93, "memory_free_mb": 345, "memory_total_mb": 8192, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 345, "memory_total_mb": 8192, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:24:09.822193Z", "process": "snmpd", "pid": 4117, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4117, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:44:09.821610Z", "process": "telemetry", "pid": 3314, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 3314, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:44:09.821210Z", "process": "bgp", "pid": 2222, "crash_count_24h": 12, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "bgp", "pid": 2222, "crash_count_24h": 12, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:06:09.815017Z", "cpu_5s_percent": 100, "cpu_1m_percent": 91, "cpu_5m_percent": 90, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 91, "cpu_5m_percent": 90, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:54:09.817570Z", "memory_used_percent": 87, "memory_free_mb": 490, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 490, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:35:09.822141Z", "process": "snmpd", "pid": 789, "crash_count_24h": 15, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 789, "crash_count_24h": 15, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:14:09.812319Z", "cpu_5s_percent": 85, "cpu_1m_percent": 80, "cpu_5m_percent": 72, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 80, "cpu_5m_percent": 72, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:53:09.815434Z", "cpu_5s_percent": 97, "cpu_1m_percent": 92, "cpu_5m_percent": 93, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 92, "cpu_5m_percent": 93, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:49:09.814005Z", "cpu_5s_percent": 86, "cpu_1m_percent": 96, "cpu_5m_percent": 94, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 96, "cpu_5m_percent": 94, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:23:09.815351Z", "cpu_5s_percent": 87, "cpu_1m_percent": 78, "cpu_5m_percent": 81, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 78, "cpu_5m_percent": 81, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:02:09.820086Z", "memory_used_percent": 90, "memory_free_mb": 226, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 226, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:22:09.817077Z", "memory_used_percent": 81, "memory_free_mb": 345, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 345, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:15:09.824168Z", "process": "snmpd", "pid": 1915, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 1915, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:52:09.822284Z", "process": "crypto", "pid": 2597, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 2597, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:28:09.817331Z", "memory_used_percent": 80, "memory_free_mb": 463, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 463, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:17:09.819869Z", "memory_used_percent": 92, "memory_free_mb": 195, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 195, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:06:09.820001Z", "memory_used_percent": 80, "memory_free_mb": 345, "memory_total_mb": 2048, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 345, "memory_total_mb": 2048, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T04:49:09.821109Z", "process": "snmpd", "pid": 380, "crash_count_24h": 6, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 380, "crash_count_24h": 6, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:10:09.815816Z", "cpu_5s_percent": 87, "cpu_1m_percent": 81, "cpu_5m_percent": 76, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 81, "cpu_5m_percent": 76, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:19:09.816915Z", "memory_used_percent": 87, "memory_free_mb": 311, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 311, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:30:09.819939Z", "memory_used_percent": 87, "memory_free_mb": 142, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 142, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:02:09.821534Z", "process": "iosd", "pid": 3781, "crash_count_24h": 5, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3781, "crash_count_24h": 5, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:50:09.816065Z", "cpu_5s_percent": 87, "cpu_1m_percent": 91, "cpu_5m_percent": 92, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 91, "cpu_5m_percent": 92, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:05:09.824149Z", "process": "bgp", "pid": 2712, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "bgp", "pid": 2712, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:53:09.820828Z", "process": "iosd", "pid": 1641, "crash_count_24h": 3, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "iosd", "pid": 1641, "crash_count_24h": 3, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:31:09.822248Z", "process": "telemetry", "pid": 1910, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 1910, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:35:09.819971Z", "memory_used_percent": 87, "memory_free_mb": 279, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 279, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:01:09.812094Z", "cpu_5s_percent": 99, "cpu_1m_percent": 84, "cpu_5m_percent": 70, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 84, "cpu_5m_percent": 70, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:13:09.817806Z", "memory_used_percent": 84, "memory_free_mb": 424, "memory_total_mb": 1024, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 424, "memory_total_mb": 1024, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:15:09.822991Z", "process": "iosd", "pid": 920, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 920, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:23:09.813361Z", "cpu_5s_percent": 95, "cpu_1m_percent": 83, "cpu_5m_percent": 70, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 83, "cpu_5m_percent": 70, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:37:09.815994Z", "cpu_5s_percent": 99, "cpu_1m_percent": 85, "cpu_5m_percent": 95, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 85, "cpu_5m_percent": 95, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:05:09.815007Z", "cpu_5s_percent": 87, "cpu_1m_percent": 75, "cpu_5m_percent": 75, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 75, "cpu_5m_percent": 75, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:56:09.820116Z", "memory_used_percent": 82, "memory_free_mb": 367, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 367, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:03:09.824159Z", "process": "snmpd", "pid": 773, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "snmpd", "pid": 773, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:18:09.815692Z", "cpu_5s_percent": 94, "cpu_1m_percent": 85, "cpu_5m_percent": 80, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 85, "cpu_5m_percent": 80, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:59:09.818254Z", "memory_used_percent": 98, "memory_free_mb": 488, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 488, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:34:09.813067Z", "cpu_5s_percent": 94, "cpu_1m_percent": 97, "cpu_5m_percent": 73, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 97, "cpu_5m_percent": 73, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:57:09.813792Z", "cpu_5s_percent": 90, "cpu_1m_percent": 82, "cpu_5m_percent": 93, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 82, "cpu_5m_percent": 93, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:42:09.813391Z", "cpu_5s_percent": 89, "cpu_1m_percent": 87, "cpu_5m_percent": 73, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 87, "cpu_5m_percent": 73, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:26:09.822305Z", "process": "snmpd", "pid": 1698, "crash_count_24h": 14, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "snmpd", "pid": 1698, "crash_count_24h": 14, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:12:09.814426Z", "cpu_5s_percent": 99, "cpu_1m_percent": 78, "cpu_5m_percent": 82, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 78, "cpu_5m_percent": 82, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:38:09.813592Z", "cpu_5s_percent": 99, "cpu_1m_percent": 91, "cpu_5m_percent": 72, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 91, "cpu_5m_percent": 72, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:53:09.822119Z", "process": "iosd", "pid": 725, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 725, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:58:09.819023Z", "memory_used_percent": 97, "memory_free_mb": 345, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 345, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:21:09.817815Z", "memory_used_percent": 99, "memory_free_mb": 465, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 465, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:19:09.820338Z", "process": "iosd", "pid": 2466, "crash_count_24h": 10, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "iosd", "pid": 2466, "crash_count_24h": 10, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:46:09.821912Z", "process": "iosd", "pid": 3894, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3894, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:23:09.818037Z", "memory_used_percent": 97, "memory_free_mb": 319, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 319, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:51:09.818765Z", "memory_used_percent": 99, "memory_free_mb": 209, "memory_total_mb": 1024, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 209, "memory_total_mb": 1024, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:16:09.816885Z", "memory_used_percent": 94, "memory_free_mb": 296, "memory_total_mb": 1024, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 296, "memory_total_mb": 1024, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:20:09.816624Z", "memory_used_percent": 84, "memory_free_mb": 124, "memory_total_mb": 2048, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 124, "memory_total_mb": 2048, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:14:09.813887Z", "cpu_5s_percent": 89, "cpu_1m_percent": 91, "cpu_5m_percent": 90, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 91, "cpu_5m_percent": 90, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:59:09.822056Z", "process": "crypto", "pid": 4176, "crash_count_24h": 20, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 4176, "crash_count_24h": 20, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:09:09.816085Z", "cpu_5s_percent": 96, "cpu_1m_percent": 99, "cpu_5m_percent": 95, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 99, "cpu_5m_percent": 95, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:51:09.815278Z", "cpu_5s_percent": 91, "cpu_1m_percent": 85, "cpu_5m_percent": 73, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 85, "cpu_5m_percent": 73, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:52:09.813507Z", "cpu_5s_percent": 96, "cpu_1m_percent": 99, "cpu_5m_percent": 88, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 99, "cpu_5m_percent": 88, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:24:09.823913Z", "process": "netconf", "pid": 3394, "crash_count_24h": 4, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "netconf", "pid": 3394, "crash_count_24h": 4, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:14:09.819371Z", "memory_used_percent": 91, "memory_free_mb": 482, "memory_total_mb": 2048, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 482, "memory_total_mb": 2048, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:48:09.815572Z", "cpu_5s_percent": 98, "cpu_1m_percent": 90, "cpu_5m_percent": 90, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 90, "cpu_5m_percent": 90, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:54:09.816482Z", "memory_used_percent": 87, "memory_free_mb": 166, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 166, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:13:09.821006Z", "process": "crypto", "pid": 2197, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 2197, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:06:09.822088Z", "process": "crypto", "pid": 966, "crash_count_24h": 14, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "crypto", "pid": 966, "crash_count_24h": 14, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:28:09.820520Z", "process": "ospf", "pid": 499, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 499, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T04:49:09.819283Z", "memory_used_percent": 88, "memory_free_mb": 133, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 133, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:39:09.822078Z", "process": "crypto", "pid": 4638, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 4638, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:28:09.822910Z", "process": "bgp", "pid": 2032, "crash_count_24h": 24, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "bgp", "pid": 2032, "crash_count_24h": 24, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:49:09.816466Z", "memory_used_percent": 88, "memory_free_mb": 158, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 158, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:28:09.816636Z", "memory_used_percent": 95, "memory_free_mb": 171, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 171, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:40:09.817699Z", "memory_used_percent": 90, "memory_free_mb": 336, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 336, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:07:09.819611Z", "memory_used_percent": 98, "memory_free_mb": 138, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 138, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:24:09.815942Z", "cpu_5s_percent": 87, "cpu_1m_percent": 99, "cpu_5m_percent": 69, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 99, "cpu_5m_percent": 69, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:38:09.823804Z", "process": "bgp", "pid": 678, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "bgp", "pid": 678, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:42:09.814240Z", "cpu_5s_percent": 98, "cpu_1m_percent": 86, "cpu_5m_percent": 76, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 86, "cpu_5m_percent": 76, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:15:09.820105Z", "memory_used_percent": 98, "memory_free_mb": 78, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 78, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:12:09.814173Z", "cpu_5s_percent": 95, "cpu_1m_percent": 94, "cpu_5m_percent": 90, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 94, "cpu_5m_percent": 90, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:39:09.819568Z", "memory_used_percent": 86, "memory_free_mb": 282, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 282, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:50:09.820652Z", "process": "netconf", "pid": 395, "crash_count_24h": 5, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 395, "crash_count_24h": 5, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:25:09.814565Z", "cpu_5s_percent": 100, "cpu_1m_percent": 83, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 83, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:57:09.818640Z", "memory_used_percent": 90, "memory_free_mb": 364, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 364, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:38:09.819262Z", "memory_used_percent": 90, "memory_free_mb": 107, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 107, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:07:09.822796Z", "process": "crypto", "pid": 1998, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1998, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T04:45:09.821783Z", "process": "netconf", "pid": 1158, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 1158, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:38:09.822848Z", "process": "bgp", "pid": 4915, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "bgp", "pid": 4915, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:12:09.816753Z", "memory_used_percent": 92, "memory_free_mb": 327, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 327, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:31:09.822067Z", "process": "iosd", "pid": 3402, "crash_count_24h": 18, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "iosd", "pid": 3402, "crash_count_24h": 18, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:44:09.821354Z", "process": "telemetry", "pid": 3727, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 3727, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:48:09.815246Z", "cpu_5s_percent": 94, "cpu_1m_percent": 87, "cpu_5m_percent": 95, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 87, "cpu_5m_percent": 95, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:35:09.822686Z", "process": "telemetry", "pid": 1540, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "telemetry", "pid": 1540, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:21:09.820390Z", "process": "crypto", "pid": 572, "crash_count_24h": 17, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "crypto", "pid": 572, "crash_count_24h": 17, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:45:09.817750Z", "memory_used_percent": 96, "memory_free_mb": 106, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 106, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T04:52:09.814664Z", "cpu_5s_percent": 96, "cpu_1m_percent": 98, "cpu_5m_percent": 79, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 98, "cpu_5m_percent": 79, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:21:09.817987Z", "memory_used_percent": 85, "memory_free_mb": 123, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 123, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:40:09.818799Z", "memory_used_percent": 82, "memory_free_mb": 341, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 341, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:33:09.815550Z", "cpu_5s_percent": 90, "cpu_1m_percent": 88, "cpu_5m_percent": 67, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 88, "cpu_5m_percent": 67, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:27:09.823487Z", "process": "telemetry", "pid": 2327, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "telemetry", "pid": 2327, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:50:09.824073Z", "process": "netconf", "pid": 1613, "crash_count_24h": 3, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 1613, "crash_count_24h": 3, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T04:52:09.818509Z", "memory_used_percent": 97, "memory_free_mb": 372, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 372, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:06:09.816114Z", "cpu_5s_percent": 94, "cpu_1m_percent": 98, "cpu_5m_percent": 90, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 98, "cpu_5m_percent": 90, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:06:09.813877Z", "cpu_5s_percent": 93, "cpu_1m_percent": 89, "cpu_5m_percent": 87, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 89, "cpu_5m_percent": 87, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:34:09.820684Z", "process": "iosd", "pid": 1297, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "iosd", "pid": 1297, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:55:09.812988Z", "cpu_5s_percent": 98, "cpu_1m_percent": 89, "cpu_5m_percent": 75, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 89, "cpu_5m_percent": 75, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:39:09.816044Z", "cpu_5s_percent": 89, "cpu_1m_percent": 84, "cpu_5m_percent": 65, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 84, "cpu_5m_percent": 65, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:21:09.823386Z", "process": "netconf", "pid": 4305, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "netconf", "pid": 4305, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:32:09.823254Z", "process": "bgp", "pid": 769, "crash_count_24h": 16, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "bgp", "pid": 769, "crash_count_24h": 16, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:39:09.820414Z", "process": "telemetry", "pid": 4920, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 4920, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:27:09.823396Z", "process": "netconf", "pid": 1181, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "netconf", "pid": 1181, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:12:09.821513Z", "process": "ospf", "pid": 3644, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3644, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:40:09.814057Z", "cpu_5s_percent": 92, "cpu_1m_percent": 82, "cpu_5m_percent": 85, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 82, "cpu_5m_percent": 85, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T04:45:09.815087Z", "cpu_5s_percent": 91, "cpu_1m_percent": 92, "cpu_5m_percent": 94, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 92, "cpu_5m_percent": 94, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:09:09.818775Z", "memory_used_percent": 83, "memory_free_mb": 471, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 471, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:51:09.822971Z", "process": "ospf", "pid": 1763, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 1763, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:45:09.822942Z", "process": "telemetry", "pid": 1925, "crash_count_24h": 15, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 1925, "crash_count_24h": 15, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:19:09.814608Z", "cpu_5s_percent": 95, "cpu_1m_percent": 86, "cpu_5m_percent": 91, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 86, "cpu_5m_percent": 91, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:59:09.816926Z", "memory_used_percent": 94, "memory_free_mb": 172, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 172, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:49:09.824102Z", "process": "iosd", "pid": 1850, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 1850, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:22:09.817473Z", "memory_used_percent": 85, "memory_free_mb": 149, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 149, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:23:09.824059Z", "process": "bgp", "pid": 3803, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 3803, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:05:09.816775Z", "memory_used_percent": 90, "memory_free_mb": 495, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 495, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:47:09.821283Z", "process": "telemetry", "pid": 1538, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 1538, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:14:09.823724Z", "process": "ospf", "pid": 800, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 800, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:48:09.814840Z", "cpu_5s_percent": 88, "cpu_1m_percent": 92, "cpu_5m_percent": 66, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 92, "cpu_5m_percent": 66, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:06:09.817689Z", "memory_used_percent": 98, "memory_free_mb": 182, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 182, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:58:09.821133Z", "process": "bgp", "pid": 355, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "bgp", "pid": 355, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:26:09.814817Z", "cpu_5s_percent": 97, "cpu_1m_percent": 98, "cpu_5m_percent": 80, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 98, "cpu_5m_percent": 80, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:56:09.815488Z", "cpu_5s_percent": 88, "cpu_1m_percent": 95, "cpu_5m_percent": 69, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 95, "cpu_5m_percent": 69, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:20:09.815320Z", "cpu_5s_percent": 88, "cpu_1m_percent": 75, "cpu_5m_percent": 77, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 75, "cpu_5m_percent": 77, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:24:09.824125Z", "process": "snmpd", "pid": 2464, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "snmpd", "pid": 2464, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:31:09.823687Z", "process": "ospf", "pid": 793, "crash_count_24h": 22, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "ospf", "pid": 793, "crash_count_24h": 22, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:53:09.823367Z", "process": "ospf", "pid": 4295, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 4295, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:19:09.818857Z", "memory_used_percent": 92, "memory_free_mb": 237, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 237, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:05:09.814735Z", "cpu_5s_percent": 98, "cpu_1m_percent": 91, "cpu_5m_percent": 78, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 91, "cpu_5m_percent": 78, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:42:09.813432Z", "cpu_5s_percent": 94, "cpu_1m_percent": 87, "cpu_5m_percent": 86, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 87, "cpu_5m_percent": 86, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:48:09.819581Z", "memory_used_percent": 95, "memory_free_mb": 399, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 399, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:22:09.820818Z", "process": "snmpd", "pid": 127, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 127, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:10:09.818176Z", "memory_used_percent": 86, "memory_free_mb": 450, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 450, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T04:50:09.812158Z", "cpu_5s_percent": 94, "cpu_1m_percent": 88, "cpu_5m_percent": 95, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 88, "cpu_5m_percent": 95, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:30:09.820950Z", "process": "crypto", "pid": 258, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "crypto", "pid": 258, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:03:09.821576Z", "process": "telemetry", "pid": 277, "crash_count_24h": 10, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "telemetry", "pid": 277, "crash_count_24h": 10, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:27:09.819034Z", "memory_used_percent": 88, "memory_free_mb": 467, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 467, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:17:09.815413Z", "cpu_5s_percent": 87, "cpu_1m_percent": 80, "cpu_5m_percent": 91, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 80, "cpu_5m_percent": 91, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T04:45:09.823780Z", "process": "iosd", "pid": 3959, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "iosd", "pid": 3959, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:24:09.812893Z", "cpu_5s_percent": 92, "cpu_1m_percent": 75, "cpu_5m_percent": 67, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 75, "cpu_5m_percent": 67, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:12:09.821067Z", "process": "crypto", "pid": 138, "crash_count_24h": 18, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 138, "crash_count_24h": 18, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:35:09.822214Z", "process": "iosd", "pid": 2040, "crash_count_24h": 3, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 2040, "crash_count_24h": 3, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:50:09.821230Z", "process": "snmpd", "pid": 3716, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "snmpd", "pid": 3716, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:54:09.815518Z", "cpu_5s_percent": 85, "cpu_1m_percent": 79, "cpu_5m_percent": 70, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 79, "cpu_5m_percent": 70, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:54:09.820879Z", "process": "snmpd", "pid": 2973, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 2973, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:00:09.818077Z", "memory_used_percent": 94, "memory_free_mb": 445, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 445, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:54:09.823734Z", "process": "netconf", "pid": 1495, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "netconf", "pid": 1495, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:43:09.818590Z", "memory_used_percent": 87, "memory_free_mb": 296, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 296, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:53:09.821739Z", "process": "crypto", "pid": 3388, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "crypto", "pid": 3388, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:28:09.823770Z", "process": "crypto", "pid": 2987, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 2987, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:09:09.818088Z", "memory_used_percent": 84, "memory_free_mb": 338, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 338, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:42:09.823224Z", "process": "telemetry", "pid": 2857, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "telemetry", "pid": 2857, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:09:09.820920Z", "process": "crypto", "pid": 4344, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 4344, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:18:09.812546Z", "cpu_5s_percent": 85, "cpu_1m_percent": 95, "cpu_5m_percent": 67, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 95, "cpu_5m_percent": 67, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:04:09.816612Z", "memory_used_percent": 92, "memory_free_mb": 276, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 276, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:21:09.813729Z", "cpu_5s_percent": 87, "cpu_1m_percent": 77, "cpu_5m_percent": 75, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 77, "cpu_5m_percent": 75, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:02:09.815962Z", "cpu_5s_percent": 93, "cpu_1m_percent": 89, "cpu_5m_percent": 93, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 89, "cpu_5m_percent": 93, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:36:09.816558Z", "memory_used_percent": 88, "memory_free_mb": 381, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 381, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:43:09.819775Z", "memory_used_percent": 93, "memory_free_mb": 460, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 460, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:18:09.819789Z", "memory_used_percent": 85, "memory_free_mb": 62, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 62, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:23:09.817638Z", "memory_used_percent": 82, "memory_free_mb": 342, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 342, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:08:09.815289Z", "cpu_5s_percent": 88, "cpu_1m_percent": 98, "cpu_5m_percent": 81, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 98, "cpu_5m_percent": 81, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:23:09.817657Z", "memory_used_percent": 98, "memory_free_mb": 155, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 155, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:10:09.814654Z", "cpu_5s_percent": 100, "cpu_1m_percent": 76, "cpu_5m_percent": 93, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 76, "cpu_5m_percent": 93, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:37:09.822261Z", "process": "iosd", "pid": 4186, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4186, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:43:09.812648Z", "cpu_5s_percent": 100, "cpu_1m_percent": 95, "cpu_5m_percent": 95, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 95, "cpu_5m_percent": 95, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:42:09.819528Z", "memory_used_percent": 85, "memory_free_mb": 343, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 343, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:34:09.817965Z", "memory_used_percent": 93, "memory_free_mb": 260, "memory_total_mb": 8192, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 260, "memory_total_mb": 8192, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:40:09.816864Z", "memory_used_percent": 98, "memory_free_mb": 266, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 266, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:03:09.820746Z", "process": "ospf", "pid": 1928, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 1928, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:05:09.814575Z", "cpu_5s_percent": 87, "cpu_1m_percent": 87, "cpu_5m_percent": 75, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 87, "cpu_5m_percent": 75, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:23:09.819660Z", "memory_used_percent": 84, "memory_free_mb": 298, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 298, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:32:09.821879Z", "process": "snmpd", "pid": 1243, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 1243, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:46:09.821772Z", "process": "bgp", "pid": 4058, "crash_count_24h": 20, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 4058, "crash_count_24h": 20, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:54:09.819811Z", "memory_used_percent": 98, "memory_free_mb": 474, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 474, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:20:09.821189Z", "process": "crypto", "pid": 402, "crash_count_24h": 25, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 402, "crash_count_24h": 25, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:54:09.814765Z", "cpu_5s_percent": 87, "cpu_1m_percent": 78, "cpu_5m_percent": 71, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 78, "cpu_5m_percent": 71, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:22:09.812409Z", "cpu_5s_percent": 85, "cpu_1m_percent": 77, "cpu_5m_percent": 84, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 77, "cpu_5m_percent": 84, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:10:09.816814Z", "memory_used_percent": 91, "memory_free_mb": 79, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 79, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:40:09.823125Z", "process": "bgp", "pid": 637, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "bgp", "pid": 637, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:21:09.817618Z", "memory_used_percent": 95, "memory_free_mb": 483, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 483, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:56:09.817893Z", "memory_used_percent": 85, "memory_free_mb": 216, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 216, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:10:09.820011Z", "memory_used_percent": 84, "memory_free_mb": 354, "memory_total_mb": 4096, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 354, "memory_total_mb": 4096, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:29:09.823095Z", "process": "iosd", "pid": 4584, "crash_count_24h": 12, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "iosd", "pid": 4584, "crash_count_24h": 12, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:50:09.814535Z", "cpu_5s_percent": 85, "cpu_1m_percent": 83, "cpu_5m_percent": 77, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 83, "cpu_5m_percent": 77, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:18:09.822327Z", "process": "netconf", "pid": 4980, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4980, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:41:09.815215Z", "cpu_5s_percent": 91, "cpu_1m_percent": 76, "cpu_5m_percent": 80, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 76, "cpu_5m_percent": 80, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:02:09.821464Z", "process": "ospf", "pid": 4016, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 4016, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:39:09.822447Z", "process": "snmpd", "pid": 3402, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3402, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:38:09.812575Z", "cpu_5s_percent": 88, "cpu_1m_percent": 89, "cpu_5m_percent": 72, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 89, "cpu_5m_percent": 72, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:01:09.818321Z", "memory_used_percent": 91, "memory_free_mb": 456, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 456, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:15:09.822622Z", "process": "ospf", "pid": 4225, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 4225, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:45:09.822357Z", "process": "crypto", "pid": 562, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 562, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:17:09.815382Z", "cpu_5s_percent": 86, "cpu_1m_percent": 99, "cpu_5m_percent": 68, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 99, "cpu_5m_percent": 68, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:50:09.822237Z", "process": "crypto", "pid": 148, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "crypto", "pid": 148, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:11:09.813802Z", "cpu_5s_percent": 95, "cpu_1m_percent": 77, "cpu_5m_percent": 89, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 77, "cpu_5m_percent": 89, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:47:09.815341Z", "cpu_5s_percent": 92, "cpu_1m_percent": 94, "cpu_5m_percent": 66, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 94, "cpu_5m_percent": 66, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:31:09.823448Z", "process": "snmpd", "pid": 2312, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 2312, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:26:09.814264Z", "cpu_5s_percent": 92, "cpu_1m_percent": 89, "cpu_5m_percent": 88, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 89, "cpu_5m_percent": 88, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:51:09.822547Z", "process": "telemetry", "pid": 4359, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "telemetry", "pid": 4359, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:34:09.813322Z", "cpu_5s_percent": 87, "cpu_1m_percent": 89, "cpu_5m_percent": 78, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 89, "cpu_5m_percent": 78, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:30:09.817285Z", "memory_used_percent": 93, "memory_free_mb": 201, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 201, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T04:48:09.813925Z", "cpu_5s_percent": 89, "cpu_1m_percent": 75, "cpu_5m_percent": 90, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 75, "cpu_5m_percent": 90, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:26:09.822774Z", "process": "telemetry", "pid": 1985, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 1985, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:05:09.814674Z", "cpu_5s_percent": 91, "cpu_1m_percent": 84, "cpu_5m_percent": 84, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 84, "cpu_5m_percent": 84, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:21:09.821310Z", "process": "snmpd", "pid": 4406, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "snmpd", "pid": 4406, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:46:09.815593Z", "cpu_5s_percent": 97, "cpu_1m_percent": 80, "cpu_5m_percent": 68, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 80, "cpu_5m_percent": 68, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:14:09.814385Z", "cpu_5s_percent": 85, "cpu_1m_percent": 88, "cpu_5m_percent": 74, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 88, "cpu_5m_percent": 74, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:42:09.821762Z", "process": "netconf", "pid": 2580, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "netconf", "pid": 2580, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:23:09.815643Z", "cpu_5s_percent": 97, "cpu_1m_percent": 90, "cpu_5m_percent": 73, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 90, "cpu_5m_percent": 73, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:53:09.823668Z", "process": "netconf", "pid": 4302, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4302, "crash_count_24h": 23, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:19:09.822495Z", "process": "ospf", "pid": 3049, "crash_count_24h": 24, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3049, "crash_count_24h": 24, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:08:09.813949Z", "cpu_5s_percent": 85, "cpu_1m_percent": 89, "cpu_5m_percent": 65, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 89, "cpu_5m_percent": 65, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:44:09.815204Z", "cpu_5s_percent": 96, "cpu_1m_percent": 79, "cpu_5m_percent": 71, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 79, "cpu_5m_percent": 71, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:50:09.816701Z", "memory_used_percent": 84, "memory_free_mb": 500, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 500, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:18:09.819889Z", "memory_used_percent": 93, "memory_free_mb": 183, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 183, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:32:09.812679Z", "cpu_5s_percent": 89, "cpu_1m_percent": 88, "cpu_5m_percent": 75, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 88, "cpu_5m_percent": 75, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:47:09.821334Z", "process": "iosd", "pid": 3451, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "iosd", "pid": 3451, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:52:09.813144Z", "cpu_5s_percent": 91, "cpu_1m_percent": 81, "cpu_5m_percent": 93, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 81, "cpu_5m_percent": 93, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:41:09.818832Z", "memory_used_percent": 97, "memory_free_mb": 61, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 61, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:36:09.814925Z", "cpu_5s_percent": 86, "cpu_1m_percent": 85, "cpu_5m_percent": 85, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 85, "cpu_5m_percent": 85, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:35:09.821599Z", "process": "crypto", "pid": 2232, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 2232, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:38:09.815777Z", "cpu_5s_percent": 91, "cpu_1m_percent": 78, "cpu_5m_percent": 69, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 78, "cpu_5m_percent": 69, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:09:09.820021Z", "memory_used_percent": 91, "memory_free_mb": 432, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 432, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:01:09.822716Z", "process": "iosd", "pid": 4850, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "iosd", "pid": 4850, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:19:09.815560Z", "cpu_5s_percent": 91, "cpu_1m_percent": 80, "cpu_5m_percent": 91, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 80, "cpu_5m_percent": 91, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:01:09.815613Z", "cpu_5s_percent": 97, "cpu_1m_percent": 96, "cpu_5m_percent": 86, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 96, "cpu_5m_percent": 86, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:22:09.812524Z", "cpu_5s_percent": 93, "cpu_1m_percent": 85, "cpu_5m_percent": 83, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 85, "cpu_5m_percent": 83, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:05:09.814884Z", "cpu_5s_percent": 87, "cpu_1m_percent": 93, "cpu_5m_percent": 66, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 93, "cpu_5m_percent": 66, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:47:09.824005Z", "process": "iosd", "pid": 4196, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4196, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:04:09.812626Z", "cpu_5s_percent": 90, "cpu_1m_percent": 89, "cpu_5m_percent": 79, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 89, "cpu_5m_percent": 79, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:57:09.818549Z", "memory_used_percent": 98, "memory_free_mb": 279, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 279, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:33:09.818207Z", "memory_used_percent": 86, "memory_free_mb": 284, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 284, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:14:09.818705Z", "memory_used_percent": 89, "memory_free_mb": 477, "memory_total_mb": 1024, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 477, "memory_total_mb": 1024, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:48:09.813053Z", "cpu_5s_percent": 85, "cpu_1m_percent": 98, "cpu_5m_percent": 65, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 98, "cpu_5m_percent": 65, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:20:09.813770Z", "cpu_5s_percent": 89, "cpu_1m_percent": 87, "cpu_5m_percent": 68, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 87, "cpu_5m_percent": 68, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:42:09.815309Z", "cpu_5s_percent": 88, "cpu_1m_percent": 94, "cpu_5m_percent": 65, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 94, "cpu_5m_percent": 65, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:16:09.813331Z", "cpu_5s_percent": 90, "cpu_1m_percent": 94, "cpu_5m_percent": 95, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 94, "cpu_5m_percent": 95, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:50:09.822746Z", "process": "bgp", "pid": 3899, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 3899, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:05:09.820479Z", "process": "iosd", "pid": 2685, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "iosd", "pid": 2685, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:06:09.813982Z", "cpu_5s_percent": 93, "cpu_1m_percent": 97, "cpu_5m_percent": 82, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 97, "cpu_5m_percent": 82, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:20:09.812355Z", "cpu_5s_percent": 97, "cpu_1m_percent": 83, "cpu_5m_percent": 74, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 83, "cpu_5m_percent": 74, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:51:09.818285Z", "memory_used_percent": 87, "memory_free_mb": 469, "memory_total_mb": 8192, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 469, "memory_total_mb": 8192, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:59:09.822099Z", "process": "bgp", "pid": 1854, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 1854, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:08:09.818868Z", "memory_used_percent": 85, "memory_free_mb": 452, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 452, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:12:09.823282Z", "process": "telemetry", "pid": 3301, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 3301, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:45:09.821544Z", "process": "ospf", "pid": 1768, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "ospf", "pid": 1768, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:48:09.816601Z", "memory_used_percent": 90, "memory_free_mb": 422, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 422, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:13:09.812700Z", "cpu_5s_percent": 87, "cpu_1m_percent": 93, "cpu_5m_percent": 77, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 93, "cpu_5m_percent": 77, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:37:09.821154Z", "process": "snmpd", "pid": 2935, "crash_count_24h": 5, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 2935, "crash_count_24h": 5, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:23:09.813196Z", "cpu_5s_percent": 90, "cpu_1m_percent": 78, "cpu_5m_percent": 89, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 78, "cpu_5m_percent": 89, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:09:09.818685Z", "memory_used_percent": 82, "memory_free_mb": 195, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 195, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:23:09.816895Z", "memory_used_percent": 83, "memory_free_mb": 446, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 446, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:44:09.814556Z", "cpu_5s_percent": 89, "cpu_1m_percent": 90, "cpu_5m_percent": 70, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 90, "cpu_5m_percent": 70, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:57:09.823081Z", "process": "telemetry", "pid": 4130, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 4130, "crash_count_24h": 2, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:08:09.818133Z", "memory_used_percent": 92, "memory_free_mb": 125, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 125, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:43:09.821399Z", "process": "crypto", "pid": 2152, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 2152, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:01:09.816690Z", "memory_used_percent": 82, "memory_free_mb": 495, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 495, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:09:09.824090Z", "process": "crypto", "pid": 2680, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 2680, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:22:09.823235Z", "process": "ospf", "pid": 4577, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 4577, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:19:09.813655Z", "cpu_5s_percent": 92, "cpu_1m_percent": 96, "cpu_5m_percent": 74, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 96, "cpu_5m_percent": 74, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:06:09.812535Z", "cpu_5s_percent": 100, "cpu_1m_percent": 80, "cpu_5m_percent": 92, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 80, "cpu_5m_percent": 92, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:16:09.817367Z", "memory_used_percent": 80, "memory_free_mb": 345, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 345, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:12:09.813283Z", "cpu_5s_percent": 87, "cpu_1m_percent": 86, "cpu_5m_percent": 78, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 86, "cpu_5m_percent": 78, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:39:09.818661Z", "memory_used_percent": 97, "memory_free_mb": 333, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 333, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:15:09.814860Z", "cpu_5s_percent": 89, "cpu_1m_percent": 84, "cpu_5m_percent": 86, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 84, "cpu_5m_percent": 86, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:02:09.816854Z", "memory_used_percent": 88, "memory_free_mb": 384, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 384, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:52:09.820940Z", "process": "bgp", "pid": 2249, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "bgp", "pid": 2249, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:43:09.821524Z", "process": "bgp", "pid": 3866, "crash_count_24h": 24, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 3866, "crash_count_24h": 24, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:52:09.815653Z", "cpu_5s_percent": 88, "cpu_1m_percent": 86, "cpu_5m_percent": 90, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 86, "cpu_5m_percent": 90, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:51:09.812790Z", "cpu_5s_percent": 94, "cpu_1m_percent": 93, "cpu_5m_percent": 95, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 93, "cpu_5m_percent": 95, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:34:09.818745Z", "memory_used_percent": 82, "memory_free_mb": 366, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 366, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:14:09.819301Z", "memory_used_percent": 83, "memory_free_mb": 414, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 414, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:20:09.817443Z", "memory_used_percent": 86, "memory_free_mb": 190, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 190, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:37:09.820858Z", "process": "iosd", "pid": 2527, "crash_count_24h": 18, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "iosd", "pid": 2527, "crash_count_24h": 18, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:59:09.821481Z", "process": "iosd", "pid": 1015, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 1015, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:33:09.817143Z", "memory_used_percent": 89, "memory_free_mb": 161, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 161, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:23:09.822603Z", "process": "snmpd", "pid": 3897, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3897, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:53:09.819725Z", "memory_used_percent": 83, "memory_free_mb": 296, "memory_total_mb": 2048, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 296, "memory_total_mb": 2048, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T04:45:09.816590Z", "memory_used_percent": 98, "memory_free_mb": 271, "memory_total_mb": 8192, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 271, "memory_total_mb": 8192, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:07:09.817132Z", "memory_used_percent": 81, "memory_free_mb": 482, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 482, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:56:09.818060Z", "memory_used_percent": 98, "memory_free_mb": 159, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 159, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:45:09.818670Z", "memory_used_percent": 93, "memory_free_mb": 394, "memory_total_mb": 8192, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 394, "memory_total_mb": 8192, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:24:09.816733Z", "memory_used_percent": 91, "memory_free_mb": 454, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 454, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:14:09.812118Z", "cpu_5s_percent": 99, "cpu_1m_percent": 96, "cpu_5m_percent": 90, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 96, "cpu_5m_percent": 90, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:23:09.815424Z", "cpu_5s_percent": 89, "cpu_1m_percent": 85, "cpu_5m_percent": 90, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 85, "cpu_5m_percent": 90, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:29:09.817185Z", "memory_used_percent": 89, "memory_free_mb": 397, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 397, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:08:09.818519Z", "memory_used_percent": 92, "memory_free_mb": 442, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 442, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:52:09.823029Z", "process": "crypto", "pid": 4508, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "crypto", "pid": 4508, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:25:09.814205Z", "cpu_5s_percent": 100, "cpu_1m_percent": 82, "cpu_5m_percent": 88, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 82, "cpu_5m_percent": 88, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:21:09.818846Z", "memory_used_percent": 91, "memory_free_mb": 340, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 340, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:27:09.817274Z", "memory_used_percent": 90, "memory_free_mb": 266, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 266, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:37:09.819243Z", "memory_used_percent": 81, "memory_free_mb": 185, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 185, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:17:09.814523Z", "cpu_5s_percent": 90, "cpu_1m_percent": 98, "cpu_5m_percent": 69, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 98, "cpu_5m_percent": 69, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:41:09.818393Z", "memory_used_percent": 80, "memory_free_mb": 310, "memory_total_mb": 1024, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 310, "memory_total_mb": 1024, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:20:09.814915Z", "cpu_5s_percent": 90, "cpu_1m_percent": 92, "cpu_5m_percent": 83, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 92, "cpu_5m_percent": 83, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:20:09.816647Z", "memory_used_percent": 95, "memory_free_mb": 195, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 195, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:14:09.819506Z", "memory_used_percent": 84, "memory_free_mb": 479, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 479, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:53:09.819991Z", "memory_used_percent": 80, "memory_free_mb": 110, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 110, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:26:09.812608Z", "cpu_5s_percent": 90, "cpu_1m_percent": 80, "cpu_5m_percent": 95, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 80, "cpu_5m_percent": 95, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:51:09.817453Z", "memory_used_percent": 96, "memory_free_mb": 343, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 343, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:55:09.812431Z", "cpu_5s_percent": 97, "cpu_1m_percent": 96, "cpu_5m_percent": 77, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 96, "cpu_5m_percent": 77, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:16:09.822044Z", "process": "snmpd", "pid": 2053, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 2053, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:04:09.821664Z", "process": "bgp", "pid": 3678, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "bgp", "pid": 3678, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:02:09.819332Z", "memory_used_percent": 82, "memory_free_mb": 355, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 355, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:02:09.816512Z", "memory_used_percent": 98, "memory_free_mb": 243, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 243, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:55:09.813350Z", "cpu_5s_percent": 87, "cpu_1m_percent": 95, "cpu_5m_percent": 82, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 95, "cpu_5m_percent": 82, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:26:09.814110Z", "cpu_5s_percent": 99, "cpu_1m_percent": 84, "cpu_5m_percent": 91, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 84, "cpu_5m_percent": 91, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:59:09.824115Z", "process": "crypto", "pid": 4819, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 4819, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:24:09.814640Z", "cpu_5s_percent": 97, "cpu_1m_percent": 92, "cpu_5m_percent": 82, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 92, "cpu_5m_percent": 82, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:10:09.818724Z", "memory_used_percent": 88, "memory_free_mb": 268, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 268, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:51:09.820838Z", "process": "iosd", "pid": 2310, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 2310, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:27:09.819401Z", "memory_used_percent": 96, "memory_free_mb": 96, "memory_total_mb": 4096, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 96, "memory_total_mb": 4096, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:26:09.822204Z", "process": "netconf", "pid": 2755, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2755, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:42:09.819420Z", "memory_used_percent": 87, "memory_free_mb": 467, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 467, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:02:09.820694Z", "process": "netconf", "pid": 4642, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4642, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:00:09.818696Z", "memory_used_percent": 80, "memory_free_mb": 73, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 73, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:49:09.820280Z", "process": "snmpd", "pid": 1256, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 1256, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:31:09.818735Z", "memory_used_percent": 81, "memory_free_mb": 354, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 354, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:55:09.822131Z", "process": "snmpd", "pid": 2941, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "snmpd", "pid": 2941, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:01:09.817903Z", "memory_used_percent": 87, "memory_free_mb": 444, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 444, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:17:09.822825Z", "process": "ospf", "pid": 1155, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 1155, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:11:09.819910Z", "memory_used_percent": 96, "memory_free_mb": 125, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 125, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:46:09.817677Z", "memory_used_percent": 97, "memory_free_mb": 253, "memory_total_mb": 8192, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 253, "memory_total_mb": 8192, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:53:09.821817Z", "process": "telemetry", "pid": 2780, "crash_count_24h": 23, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "telemetry", "pid": 2780, "crash_count_24h": 23, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:49:09.813100Z", "cpu_5s_percent": 88, "cpu_1m_percent": 88, "cpu_5m_percent": 82, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 88, "cpu_5m_percent": 82, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:08:09.812461Z", "cpu_5s_percent": 88, "cpu_1m_percent": 77, "cpu_5m_percent": 72, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 77, "cpu_5m_percent": 72, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:44:09.820900Z", "process": "iosd", "pid": 4059, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "iosd", "pid": 4059, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:25:09.822417Z", "process": "iosd", "pid": 164, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 164, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:56:09.822889Z", "process": "iosd", "pid": 3417, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "iosd", "pid": 3417, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:23:09.816402Z", "memory_used_percent": 88, "memory_free_mb": 119, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 119, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:01:09.819429Z", "memory_used_percent": 90, "memory_free_mb": 450, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 450, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:20:09.816905Z", "memory_used_percent": 92, "memory_free_mb": 272, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 272, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:44:09.820031Z", "memory_used_percent": 89, "memory_free_mb": 370, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 370, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:56:09.813813Z", "cpu_5s_percent": 98, "cpu_1m_percent": 88, "cpu_5m_percent": 76, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 88, "cpu_5m_percent": 76, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:10:09.819438Z", "memory_used_percent": 83, "memory_free_mb": 409, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 409, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:21:09.820663Z", "process": "iosd", "pid": 447, "crash_count_24h": 12, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 447, "crash_count_24h": 12, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:33:09.822706Z", "process": "telemetry", "pid": 4953, "crash_count_24h": 12, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 4953, "crash_count_24h": 12, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:18:09.815972Z", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 71, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 71, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:28:09.820786Z", "process": "crypto", "pid": 2911, "crash_count_24h": 8, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 2911, "crash_count_24h": 8, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:46:09.817867Z", "memory_used_percent": 88, "memory_free_mb": 254, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 254, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:07:09.816997Z", "memory_used_percent": 96, "memory_free_mb": 229, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 229, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T04:57:09.822537Z", "process": "netconf", "pid": 4692, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "netconf", "pid": 4692, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:28:09.819346Z", "memory_used_percent": 81, "memory_free_mb": 82, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 82, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:36:09.820974Z", "process": "snmpd", "pid": 631, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "snmpd", "pid": 631, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:09:09.822557Z", "process": "snmpd", "pid": 2881, "crash_count_24h": 14, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 2881, "crash_count_24h": 14, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:53:09.813782Z", "cpu_5s_percent": 89, "cpu_1m_percent": 87, "cpu_5m_percent": 67, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 87, "cpu_5m_percent": 67, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:15:09.815583Z", "cpu_5s_percent": 94, "cpu_1m_percent": 95, "cpu_5m_percent": 85, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 95, "cpu_5m_percent": 85, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:16:09.820580Z", "process": "crypto", "pid": 2027, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "crypto", "pid": 2027, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:46:09.820963Z", "process": "telemetry", "pid": 2957, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "telemetry", "pid": 2957, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:05:09.821143Z", "process": "ospf", "pid": 3047, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3047, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:32:09.818961Z", "memory_used_percent": 99, "memory_free_mb": 436, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 436, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:35:09.823376Z", "process": "snmpd", "pid": 2802, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 2802, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:42:09.814036Z", "cpu_5s_percent": 93, "cpu_1m_percent": 91, "cpu_5m_percent": 89, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 91, "cpu_5m_percent": 89, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:53:09.818939Z", "memory_used_percent": 89, "memory_free_mb": 387, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 387, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:28:09.813130Z", "cpu_5s_percent": 91, "cpu_1m_percent": 80, "cpu_5m_percent": 75, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 80, "cpu_5m_percent": 75, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:13:09.814695Z", "cpu_5s_percent": 86, "cpu_1m_percent": 81, "cpu_5m_percent": 87, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 81, "cpu_5m_percent": 87, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:13:09.819322Z", "memory_used_percent": 97, "memory_free_mb": 398, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 398, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:45:09.816013Z", "cpu_5s_percent": 86, "cpu_1m_percent": 97, "cpu_5m_percent": 88, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 97, "cpu_5m_percent": 88, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:13:09.820457Z", "process": "netconf", "pid": 525, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "netconf", "pid": 525, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:11:09.821366Z", "process": "netconf", "pid": 4866, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "netconf", "pid": 4866, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:50:09.813120Z", "cpu_5s_percent": 93, "cpu_1m_percent": 78, "cpu_5m_percent": 68, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 78, "cpu_5m_percent": 68, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:50:09.815787Z", "cpu_5s_percent": 99, "cpu_1m_percent": 84, "cpu_5m_percent": 89, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 84, "cpu_5m_percent": 89, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:16:09.812227Z", "cpu_5s_percent": 93, "cpu_1m_percent": 96, "cpu_5m_percent": 94, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 96, "cpu_5m_percent": 94, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:20:09.813517Z", "cpu_5s_percent": 100, "cpu_1m_percent": 86, "cpu_5m_percent": 95, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 86, "cpu_5m_percent": 95, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:59:09.819003Z", "memory_used_percent": 82, "memory_free_mb": 128, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 128, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:33:09.823072Z", "process": "iosd", "pid": 1091, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "iosd", "pid": 1091, "crash_count_24h": 8, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:39:09.822583Z", "process": "telemetry", "pid": 2395, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "telemetry", "pid": 2395, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:51:09.823885Z", "process": "crypto", "pid": 4225, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 4225, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:27:09.823678Z", "process": "snmpd", "pid": 3330, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 3330, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:30:09.813561Z", "cpu_5s_percent": 86, "cpu_1m_percent": 85, "cpu_5m_percent": 88, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 85, "cpu_5m_percent": 88, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:46:09.813480Z", "cpu_5s_percent": 97, "cpu_1m_percent": 87, "cpu_5m_percent": 76, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 87, "cpu_5m_percent": 76, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:36:09.816711Z", "memory_used_percent": 90, "memory_free_mb": 441, "memory_total_mb": 8192, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 441, "memory_total_mb": 8192, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:37:09.821806Z", "process": "snmpd", "pid": 2337, "crash_count_24h": 19, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 2337, "crash_count_24h": 19, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:02:09.823004Z", "process": "bgp", "pid": 3714, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 3714, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:02:09.811979Z", "cpu_5s_percent": 96, "cpu_1m_percent": 88, "cpu_5m_percent": 92, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 88, "cpu_5m_percent": 92, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:56:09.819920Z", "memory_used_percent": 97, "memory_free_mb": 103, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 103, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:03:09.815837Z", "cpu_5s_percent": 88, "cpu_1m_percent": 97, "cpu_5m_percent": 72, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 97, "cpu_5m_percent": 72, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:28:09.814873Z", "cpu_5s_percent": 87, "cpu_1m_percent": 81, "cpu_5m_percent": 80, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 81, "cpu_5m_percent": 80, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:18:09.817234Z", "memory_used_percent": 92, "memory_free_mb": 322, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 322, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:26:09.814997Z", "cpu_5s_percent": 88, "cpu_1m_percent": 78, "cpu_5m_percent": 67, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 78, "cpu_5m_percent": 67, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:29:09.813250Z", "cpu_5s_percent": 91, "cpu_1m_percent": 98, "cpu_5m_percent": 78, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 98, "cpu_5m_percent": 78, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:17:09.813261Z", "cpu_5s_percent": 85, "cpu_1m_percent": 98, "cpu_5m_percent": 93, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 98, "cpu_5m_percent": 93, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:01:09.816452Z", "memory_used_percent": 84, "memory_free_mb": 316, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 316, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:35:09.813897Z", "cpu_5s_percent": 90, "cpu_1m_percent": 84, "cpu_5m_percent": 81, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 84, "cpu_5m_percent": 81, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:42:09.817608Z", "memory_used_percent": 83, "memory_free_mb": 160, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 160, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:06:09.812299Z", "cpu_5s_percent": 94, "cpu_1m_percent": 84, "cpu_5m_percent": 86, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 84, "cpu_5m_percent": 86, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:02:09.820736Z", "process": "snmpd", "pid": 3003, "crash_count_24h": 21, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3003, "crash_count_24h": 21, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T04:51:09.822756Z", "process": "snmpd", "pid": 2892, "crash_count_24h": 18, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "snmpd", "pid": 2892, "crash_count_24h": 18, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:53:09.814333Z", "cpu_5s_percent": 93, "cpu_1m_percent": 89, "cpu_5m_percent": 95, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 89, "cpu_5m_percent": 95, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:52:09.816743Z", "memory_used_percent": 81, "memory_free_mb": 161, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 161, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:29:09.817648Z", "memory_used_percent": 83, "memory_free_mb": 442, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 442, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:34:09.817912Z", "memory_used_percent": 81, "memory_free_mb": 418, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 418, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:25:09.818888Z", "memory_used_percent": 86, "memory_free_mb": 65, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 65, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:38:09.814416Z", "cpu_5s_percent": 100, "cpu_1m_percent": 81, "cpu_5m_percent": 83, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 81, "cpu_5m_percent": 83, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:17:09.814437Z", "cpu_5s_percent": 95, "cpu_1m_percent": 82, "cpu_5m_percent": 73, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 82, "cpu_5m_percent": 73, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:00:09.818112Z", "memory_used_percent": 91, "memory_free_mb": 174, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 174, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:23:09.815236Z", "cpu_5s_percent": 99, "cpu_1m_percent": 78, "cpu_5m_percent": 85, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 78, "cpu_5m_percent": 85, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:42:09.814725Z", "cpu_5s_percent": 98, "cpu_1m_percent": 82, "cpu_5m_percent": 84, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 82, "cpu_5m_percent": 84, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:15:09.823790Z", "process": "netconf", "pid": 1134, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "netconf", "pid": 1134, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:11:09.815456Z", "cpu_5s_percent": 97, "cpu_1m_percent": 94, "cpu_5m_percent": 78, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 94, "cpu_5m_percent": 78, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:28:09.821026Z", "process": "crypto", "pid": 2253, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 2253, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:13:09.815098Z", "cpu_5s_percent": 97, "cpu_1m_percent": 92, "cpu_5m_percent": 65, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 92, "cpu_5m_percent": 65, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:30:09.819448Z", "memory_used_percent": 84, "memory_free_mb": 455, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 455, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:07:09.818340Z", "memory_used_percent": 93, "memory_free_mb": 186, "memory_total_mb": 8192, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 186, "memory_total_mb": 8192, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:43:09.820910Z", "process": "netconf", "pid": 821, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 821, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:18:09.814274Z", "cpu_5s_percent": 90, "cpu_1m_percent": 89, "cpu_5m_percent": 94, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 89, "cpu_5m_percent": 94, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:41:09.815671Z", "cpu_5s_percent": 88, "cpu_1m_percent": 99, "cpu_5m_percent": 92, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 99, "cpu_5m_percent": 92, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:43:09.819194Z", "memory_used_percent": 87, "memory_free_mb": 462, "memory_total_mb": 1024, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 462, "memory_total_mb": 1024, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:51:09.819549Z", "memory_used_percent": 96, "memory_free_mb": 423, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 423, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:50:09.817154Z", "memory_used_percent": 82, "memory_free_mb": 53, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 53, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:27:09.821016Z", "process": "ospf", "pid": 3150, "crash_count_24h": 2, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 3150, "crash_count_24h": 2, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:22:09.813582Z", "cpu_5s_percent": 98, "cpu_1m_percent": 96, "cpu_5m_percent": 65, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 96, "cpu_5m_percent": 65, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:49:09.813709Z", "cpu_5s_percent": 87, "cpu_1m_percent": 85, "cpu_5m_percent": 83, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 85, "cpu_5m_percent": 83, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:40:09.820985Z", "process": "snmpd", "pid": 400, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 400, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:22:09.818405Z", "memory_used_percent": 91, "memory_free_mb": 477, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 477, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:59:09.822151Z", "process": "netconf", "pid": 4060, "crash_count_24h": 21, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4060, "crash_count_24h": 21, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:09:09.820327Z", "process": "telemetry", "pid": 3064, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 3064, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:40:09.817390Z", "memory_used_percent": 98, "memory_free_mb": 138, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 138, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:43:09.814597Z", "cpu_5s_percent": 87, "cpu_1m_percent": 93, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 93, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:57:09.812139Z", "cpu_5s_percent": 94, "cpu_1m_percent": 88, "cpu_5m_percent": 83, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 88, "cpu_5m_percent": 83, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:19:09.820401Z", "process": "ospf", "pid": 434, "crash_count_24h": 10, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 434, "crash_count_24h": 10, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:47:09.816669Z", "memory_used_percent": 83, "memory_free_mb": 386, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 386, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:41:09.821944Z", "process": "telemetry", "pid": 1439, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 1439, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:36:09.814196Z", "cpu_5s_percent": 98, "cpu_1m_percent": 91, "cpu_5m_percent": 66, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 91, "cpu_5m_percent": 66, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:21:09.817221Z", "memory_used_percent": 91, "memory_free_mb": 345, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 345, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:41:09.816804Z", "memory_used_percent": 93, "memory_free_mb": 237, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 237, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:31:09.820096Z", "memory_used_percent": 95, "memory_free_mb": 119, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 119, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:25:09.818715Z", "memory_used_percent": 82, "memory_free_mb": 325, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 325, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:13:09.821858Z", "process": "iosd", "pid": 462, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 462, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:31:09.822406Z", "process": "netconf", "pid": 4065, "crash_count_24h": 2, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4065, "crash_count_24h": 2, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:18:09.822505Z", "process": "crypto", "pid": 3881, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 3881, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:16:09.821555Z", "process": "bgp", "pid": 499, "crash_count_24h": 22, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "bgp", "pid": 499, "crash_count_24h": 22, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:49:09.813441Z", "cpu_5s_percent": 91, "cpu_1m_percent": 82, "cpu_5m_percent": 91, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 82, "cpu_5m_percent": 91, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:23:09.817795Z", "memory_used_percent": 91, "memory_free_mb": 130, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 130, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:31:09.812637Z", "cpu_5s_percent": 87, "cpu_1m_percent": 99, "cpu_5m_percent": 90, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 99, "cpu_5m_percent": 90, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:21:09.818264Z", "memory_used_percent": 96, "memory_free_mb": 88, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 88, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:00:09.816721Z", "memory_used_percent": 83, "memory_free_mb": 484, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 484, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:38:09.821934Z", "process": "bgp", "pid": 2103, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "bgp", "pid": 2103, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:32:09.813293Z", "cpu_5s_percent": 93, "cpu_1m_percent": 85, "cpu_5m_percent": 80, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 85, "cpu_5m_percent": 80, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:34:09.821889Z", "process": "iosd", "pid": 4817, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4817, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:10:09.816055Z", "cpu_5s_percent": 89, "cpu_1m_percent": 75, "cpu_5m_percent": 84, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 75, "cpu_5m_percent": 84, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:16:09.812482Z", "cpu_5s_percent": 100, "cpu_1m_percent": 88, "cpu_5m_percent": 91, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 88, "cpu_5m_percent": 91, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:27:09.819124Z", "memory_used_percent": 95, "memory_free_mb": 308, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 308, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:59:09.820361Z", "process": "snmpd", "pid": 1042, "crash_count_24h": 10, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 1042, "crash_count_24h": 10, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:25:09.821848Z", "process": "iosd", "pid": 3895, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3895, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:41:09.817121Z", "memory_used_percent": 84, "memory_free_mb": 450, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 450, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:02:09.823053Z", "process": "iosd", "pid": 2280, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "iosd", "pid": 2280, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:16:09.819312Z", "memory_used_percent": 92, "memory_free_mb": 325, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 325, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:12:09.815858Z", "cpu_5s_percent": 93, "cpu_1m_percent": 75, "cpu_5m_percent": 83, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 75, "cpu_5m_percent": 83, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:04:09.814904Z", "cpu_5s_percent": 99, "cpu_1m_percent": 85, "cpu_5m_percent": 78, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 85, "cpu_5m_percent": 78, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:37:09.816875Z", "memory_used_percent": 98, "memory_free_mb": 398, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 398, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:08:09.818810Z", "memory_used_percent": 96, "memory_free_mb": 430, "memory_total_mb": 1024, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 430, "memory_total_mb": 1024, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:13:09.813341Z", "cpu_5s_percent": 99, "cpu_1m_percent": 80, "cpu_5m_percent": 79, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 80, "cpu_5m_percent": 79, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:02:09.820446Z", "process": "crypto", "pid": 547, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 547, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:05:09.815404Z", "cpu_5s_percent": 92, "cpu_1m_percent": 98, "cpu_5m_percent": 71, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 98, "cpu_5m_percent": 71, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:37:09.819083Z", "memory_used_percent": 98, "memory_free_mb": 104, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 104, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:41:09.823991Z", "process": "telemetry", "pid": 4561, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 4561, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:10:09.817827Z", "memory_used_percent": 90, "memory_free_mb": 272, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 272, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:22:09.815077Z", "cpu_5s_percent": 90, "cpu_1m_percent": 76, "cpu_5m_percent": 83, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 76, "cpu_5m_percent": 83, "top_process": "SNMP ENGINE"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:58:09.820425Z", "process": "ospf", "pid": 1963, "crash_count_24h": 21, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 1963, "crash_count_24h": 21, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T04:48:09.823658Z", "process": "ospf", "pid": 2080, "crash_count_24h": 21, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 2080, "crash_count_24h": 21, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:18:09.818274Z", "memory_used_percent": 84, "memory_free_mb": 199, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 199, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:40:09.812514Z", "cpu_5s_percent": 93, "cpu_1m_percent": 82, "cpu_5m_percent": 74, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 82, "cpu_5m_percent": 74, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:24:09.820705Z", "process": "crypto", "pid": 107, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 107, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:53:09.822295Z", "process": "netconf", "pid": 3955, "crash_count_24h": 17, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 3955, "crash_count_24h": 17, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:08:09.820756Z", "process": "snmpd", "pid": 2259, "crash_count_24h": 23, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "snmpd", "pid": 2259, "crash_count_24h": 23, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:58:09.821827Z", "process": "telemetry", "pid": 136, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 136, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:37:09.813207Z", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 91, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 91, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:19:09.816440Z", "memory_used_percent": 92, "memory_free_mb": 401, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 401, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:13:09.814944Z", "cpu_5s_percent": 88, "cpu_1m_percent": 90, "cpu_5m_percent": 85, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 90, "cpu_5m_percent": 85, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:46:09.815056Z", "cpu_5s_percent": 91, "cpu_1m_percent": 78, "cpu_5m_percent": 65, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 78, "cpu_5m_percent": 65, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:17:09.819178Z", "memory_used_percent": 84, "memory_free_mb": 481, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 481, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:54:09.822338Z", "process": "iosd", "pid": 4618, "crash_count_24h": 2, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4618, "crash_count_24h": 2, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:32:09.823703Z", "process": "netconf", "pid": 1393, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "netconf", "pid": 1393, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:07:09.820502Z", "process": "iosd", "pid": 2340, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "iosd", "pid": 2340, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:37:09.814120Z", "cpu_5s_percent": 91, "cpu_1m_percent": 84, "cpu_5m_percent": 76, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 84, "cpu_5m_percent": 76, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:14:09.817858Z", "memory_used_percent": 87, "memory_free_mb": 472, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 472, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:20:09.815602Z", "cpu_5s_percent": 86, "cpu_1m_percent": 81, "cpu_5m_percent": 83, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 81, "cpu_5m_percent": 83, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:37:09.814894Z", "cpu_5s_percent": 89, "cpu_1m_percent": 87, "cpu_5m_percent": 87, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 87, "cpu_5m_percent": 87, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:02:09.812557Z", "cpu_5s_percent": 97, "cpu_1m_percent": 80, "cpu_5m_percent": 89, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 80, "cpu_5m_percent": 89, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:03:09.815633Z", "cpu_5s_percent": 93, "cpu_1m_percent": 77, "cpu_5m_percent": 80, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 77, "cpu_5m_percent": 80, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:03:09.823115Z", "process": "telemetry", "pid": 2774, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 2774, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:24:09.815911Z", "cpu_5s_percent": 89, "cpu_1m_percent": 78, "cpu_5m_percent": 72, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 78, "cpu_5m_percent": 72, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:33:09.814142Z", "cpu_5s_percent": 91, "cpu_1m_percent": 92, "cpu_5m_percent": 78, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 92, "cpu_5m_percent": 78, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:56:09.813238Z", "cpu_5s_percent": 90, "cpu_1m_percent": 89, "cpu_5m_percent": 65, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 89, "cpu_5m_percent": 65, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:40:09.818330Z", "memory_used_percent": 97, "memory_free_mb": 325, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 325, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:23:09.815952Z", "cpu_5s_percent": 89, "cpu_1m_percent": 76, "cpu_5m_percent": 77, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 76, "cpu_5m_percent": 77, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:07:09.816825Z", "memory_used_percent": 93, "memory_free_mb": 337, "memory_total_mb": 8192, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 337, "memory_total_mb": 8192, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:48:09.817509Z", "memory_used_percent": 86, "memory_free_mb": 383, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 383, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:50:09.818440Z", "memory_used_percent": 92, "memory_free_mb": 427, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 427, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:44:09.822438Z", "process": "iosd", "pid": 2958, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 2958, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:42:09.815922Z", "cpu_5s_percent": 90, "cpu_1m_percent": 81, "cpu_5m_percent": 94, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 81, "cpu_5m_percent": 94, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:07:09.815897Z", "cpu_5s_percent": 98, "cpu_1m_percent": 86, "cpu_5m_percent": 89, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 86, "cpu_5m_percent": 89, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:41:09.822380Z", "process": "crypto", "pid": 587, "crash_count_24h": 5, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 587, "crash_count_24h": 5, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:32:09.818227Z", "memory_used_percent": 97, "memory_free_mb": 445, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 445, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:42:09.819821Z", "memory_used_percent": 91, "memory_free_mb": 335, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 335, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:53:09.815361Z", "cpu_5s_percent": 87, "cpu_1m_percent": 85, "cpu_5m_percent": 94, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 85, "cpu_5m_percent": 94, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:49:09.822652Z", "process": "bgp", "pid": 4552, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "bgp", "pid": 4552, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:11:09.821682Z", "process": "netconf", "pid": 2907, "crash_count_24h": 23, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2907, "crash_count_24h": 23, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:50:09.820041Z", "memory_used_percent": 86, "memory_free_mb": 311, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 311, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:51:09.818144Z", "memory_used_percent": 86, "memory_free_mb": 50, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 50, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:11:09.823970Z", "process": "crypto", "pid": 4237, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "crypto", "pid": 4237, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:03:09.812338Z", "cpu_5s_percent": 87, "cpu_1m_percent": 86, "cpu_5m_percent": 87, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 86, "cpu_5m_percent": 87, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:25:09.818539Z", "memory_used_percent": 96, "memory_free_mb": 76, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 76, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:36:09.815733Z", "cpu_5s_percent": 100, "cpu_1m_percent": 85, "cpu_5m_percent": 94, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 85, "cpu_5m_percent": 94, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:59:09.819013Z", "memory_used_percent": 85, "memory_free_mb": 99, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 99, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:13:09.818476Z", "memory_used_percent": 86, "memory_free_mb": 183, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 183, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:08:09.812067Z", "cpu_5s_percent": 89, "cpu_1m_percent": 86, "cpu_5m_percent": 90, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 86, "cpu_5m_percent": 90, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:10:09.812275Z", "cpu_5s_percent": 98, "cpu_1m_percent": 94, "cpu_5m_percent": 94, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 94, "cpu_5m_percent": 94, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:42:09.823272Z", "process": "telemetry", "pid": 1857, "crash_count_24h": 13, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "telemetry", "pid": 1857, "crash_count_24h": 13, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:06:09.824015Z", "process": "iosd", "pid": 3279, "crash_count_24h": 10, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "iosd", "pid": 3279, "crash_count_24h": 10, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:51:09.819800Z", "memory_used_percent": 84, "memory_free_mb": 174, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 174, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:28:09.821751Z", "process": "ospf", "pid": 3248, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "ospf", "pid": 3248, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:38:09.822675Z", "process": "crypto", "pid": 2263, "crash_count_24h": 8, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 2263, "crash_count_24h": 8, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:04:09.814396Z", "cpu_5s_percent": 88, "cpu_1m_percent": 90, "cpu_5m_percent": 82, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 90, "cpu_5m_percent": 82, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:39:09.823321Z", "process": "ospf", "pid": 4643, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "ospf", "pid": 4643, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:16:09.813312Z", "cpu_5s_percent": 91, "cpu_1m_percent": 98, "cpu_5m_percent": 95, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 98, "cpu_5m_percent": 95, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:04:09.822481Z", "process": "ospf", "pid": 918, "crash_count_24h": 15, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 918, "crash_count_24h": 15, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:22:09.815067Z", "cpu_5s_percent": 97, "cpu_1m_percent": 83, "cpu_5m_percent": 95, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 83, "cpu_5m_percent": 95, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:41:09.821260Z", "process": "netconf", "pid": 1174, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 1174, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:24:09.814185Z", "cpu_5s_percent": 90, "cpu_1m_percent": 95, "cpu_5m_percent": 86, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 95, "cpu_5m_percent": 86, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:31:09.813620Z", "cpu_5s_percent": 97, "cpu_1m_percent": 93, "cpu_5m_percent": 87, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 93, "cpu_5m_percent": 87, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:54:09.816033Z", "cpu_5s_percent": 91, "cpu_1m_percent": 90, "cpu_5m_percent": 78, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 90, "cpu_5m_percent": 78, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:43:09.818977Z", "memory_used_percent": 86, "memory_free_mb": 294, "memory_total_mb": 1024, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 294, "memory_total_mb": 1024, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:31:09.820491Z", "process": "iosd", "pid": 1129, "crash_count_24h": 17, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 1129, "crash_count_24h": 17, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:57:09.816835Z", "memory_used_percent": 86, "memory_free_mb": 205, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 205, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:29:09.814806Z", "cpu_5s_percent": 94, "cpu_1m_percent": 76, "cpu_5m_percent": 73, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 76, "cpu_5m_percent": 73, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:22:09.820726Z", "process": "ospf", "pid": 782, "crash_count_24h": 25, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "ospf", "pid": 782, "crash_count_24h": 25, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:54:09.821955Z", "process": "snmpd", "pid": 995, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 995, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:57:09.814934Z", "cpu_5s_percent": 98, "cpu_1m_percent": 88, "cpu_5m_percent": 77, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 88, "cpu_5m_percent": 77, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:36:09.818600Z", "memory_used_percent": 87, "memory_free_mb": 278, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 278, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:49:09.823014Z", "process": "netconf", "pid": 239, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 239, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:28:09.822812Z", "process": "bgp", "pid": 3331, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 3331, "crash_count_24h": 25, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:07:09.818465Z", "memory_used_percent": 92, "memory_free_mb": 60, "memory_total_mb": 4096, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 60, "memory_total_mb": 4096, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:02:09.822932Z", "process": "crypto", "pid": 4438, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 4438, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:53:09.823209Z", "process": "crypto", "pid": 943, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 943, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:54:09.823039Z", "process": "telemetry", "pid": 2020, "crash_count_24h": 2, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "telemetry", "pid": 2020, "crash_count_24h": 2, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:18:09.813611Z", "cpu_5s_percent": 92, "cpu_1m_percent": 96, "cpu_5m_percent": 94, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 96, "cpu_5m_percent": 94, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:58:09.812767Z", "cpu_5s_percent": 85, "cpu_1m_percent": 85, "cpu_5m_percent": 77, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 85, "cpu_5m_percent": 77, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:58:09.822868Z", "process": "netconf", "pid": 3884, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 3884, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:12:09.814830Z", "cpu_5s_percent": 91, "cpu_1m_percent": 98, "cpu_5m_percent": 72, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 98, "cpu_5m_percent": 72, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:03:09.813496Z", "cpu_5s_percent": 93, "cpu_1m_percent": 93, "cpu_5m_percent": 68, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 93, "cpu_5m_percent": 68, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:37:09.819044Z", "memory_used_percent": 90, "memory_free_mb": 247, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 247, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:06:09.815932Z", "cpu_5s_percent": 92, "cpu_1m_percent": 87, "cpu_5m_percent": 85, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 87, "cpu_5m_percent": 85, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:26:09.821726Z", "process": "snmpd", "pid": 4083, "crash_count_24h": 20, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4083, "crash_count_24h": 20, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:14:09.815623Z", "cpu_5s_percent": 87, "cpu_1m_percent": 91, "cpu_5m_percent": 79, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 91, "cpu_5m_percent": 79, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:39:09.818350Z", "memory_used_percent": 95, "memory_free_mb": 500, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 500, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:29:09.819410Z", "memory_used_percent": 83, "memory_free_mb": 401, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 401, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:33:09.814684Z", "cpu_5s_percent": 85, "cpu_1m_percent": 85, "cpu_5m_percent": 92, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 85, "cpu_5m_percent": 92, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:08:09.817519Z", "memory_used_percent": 93, "memory_free_mb": 190, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 190, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:57:09.813016Z", "cpu_5s_percent": 99, "cpu_1m_percent": 79, "cpu_5m_percent": 73, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 79, "cpu_5m_percent": 73, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:02:09.822858Z", "process": "iosd", "pid": 907, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 907, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:26:09.817760Z", "memory_used_percent": 95, "memory_free_mb": 446, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 446, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:01:09.812503Z", "cpu_5s_percent": 85, "cpu_1m_percent": 86, "cpu_5m_percent": 77, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 86, "cpu_5m_percent": 77, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:51:09.815476Z", "cpu_5s_percent": 94, "cpu_1m_percent": 79, "cpu_5m_percent": 73, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 79, "cpu_5m_percent": 73, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:55:09.823136Z", "process": "iosd", "pid": 4232, "crash_count_24h": 10, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4232, "crash_count_24h": 10, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:41:09.818217Z", "memory_used_percent": 96, "memory_free_mb": 451, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 451, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:35:09.816416Z", "memory_used_percent": 85, "memory_free_mb": 208, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 208, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:14:09.816580Z", "memory_used_percent": 97, "memory_free_mb": 484, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 484, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:58:09.813993Z", "cpu_5s_percent": 97, "cpu_1m_percent": 79, "cpu_5m_percent": 84, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 79, "cpu_5m_percent": 84, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:01:09.819205Z", "memory_used_percent": 99, "memory_free_mb": 498, "memory_total_mb": 4096, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 498, "memory_total_mb": 4096, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:31:09.820554Z", "process": "netconf", "pid": 3155, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "netconf", "pid": 3155, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:57:09.819253Z", "memory_used_percent": 86, "memory_free_mb": 238, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 238, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:29:09.813421Z", "cpu_5s_percent": 88, "cpu_1m_percent": 92, "cpu_5m_percent": 68, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 92, "cpu_5m_percent": 68, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:29:09.813227Z", "cpu_5s_percent": 89, "cpu_1m_percent": 91, "cpu_5m_percent": 86, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 91, "cpu_5m_percent": 86, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:11:09.819292Z", "memory_used_percent": 94, "memory_free_mb": 369, "memory_total_mb": 1024, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 369, "memory_total_mb": 1024, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:38:09.820532Z", "process": "netconf", "pid": 998, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "netconf", "pid": 998, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:37:09.817598Z", "memory_used_percent": 91, "memory_free_mb": 454, "memory_total_mb": 4096, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 454, "memory_total_mb": 4096, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:45:09.813939Z", "cpu_5s_percent": 91, "cpu_1m_percent": 98, "cpu_5m_percent": 80, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 98, "cpu_5m_percent": 80, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:40:09.817413Z", "memory_used_percent": 80, "memory_free_mb": 323, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 323, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:21:09.817722Z", "memory_used_percent": 95, "memory_free_mb": 178, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 178, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:13:09.822697Z", "process": "iosd", "pid": 1405, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "iosd", "pid": 1405, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:35:09.819859Z", "memory_used_percent": 84, "memory_free_mb": 480, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 480, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:37:09.815190Z", "cpu_5s_percent": 91, "cpu_1m_percent": 89, "cpu_5m_percent": 84, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 89, "cpu_5m_percent": 84, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:17:09.817164Z", "memory_used_percent": 87, "memory_free_mb": 60, "memory_total_mb": 1024, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 60, "memory_total_mb": 1024, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:49:09.818823Z", "memory_used_percent": 86, "memory_free_mb": 113, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 113, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:32:09.815722Z", "cpu_5s_percent": 95, "cpu_1m_percent": 94, "cpu_5m_percent": 68, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 94, "cpu_5m_percent": 68, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:30:09.817999Z", "memory_used_percent": 85, "memory_free_mb": 400, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 400, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:48:09.814586Z", "cpu_5s_percent": 90, "cpu_1m_percent": 96, "cpu_5m_percent": 89, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 96, "cpu_5m_percent": 89, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:18:09.813527Z", "cpu_5s_percent": 90, "cpu_1m_percent": 81, "cpu_5m_percent": 88, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 81, "cpu_5m_percent": 88, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:45:09.820930Z", "process": "netconf", "pid": 322, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "netconf", "pid": 322, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:09:09.814546Z", "cpu_5s_percent": 89, "cpu_1m_percent": 86, "cpu_5m_percent": 89, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 86, "cpu_5m_percent": 89, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:34:09.819898Z", "memory_used_percent": 95, "memory_free_mb": 211, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 211, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:07:09.817542Z", "memory_used_percent": 86, "memory_free_mb": 448, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 448, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:47:09.813401Z", "cpu_5s_percent": 85, "cpu_1m_percent": 92, "cpu_5m_percent": 77, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 92, "cpu_5m_percent": 77, "top_process": "CEF RP"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:04:09.815711Z", "cpu_5s_percent": 92, "cpu_1m_percent": 82, "cpu_5m_percent": 93, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 82, "cpu_5m_percent": 93, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:10:09.819601Z", "memory_used_percent": 80, "memory_free_mb": 313, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 313, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:21:09.823843Z", "process": "bgp", "pid": 2508, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 2508, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:54:09.816845Z", "memory_used_percent": 98, "memory_free_mb": 160, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 160, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:04:09.812669Z", "cpu_5s_percent": 92, "cpu_1m_percent": 94, "cpu_5m_percent": 67, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 94, "cpu_5m_percent": 67, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:40:09.820848Z", "process": "ospf", "pid": 1838, "crash_count_24h": 25, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 1838, "crash_count_24h": 25, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:55:09.813176Z", "cpu_5s_percent": 100, "cpu_1m_percent": 97, "cpu_5m_percent": 79, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 97, "cpu_5m_percent": 79, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:05:09.817738Z", "memory_used_percent": 85, "memory_free_mb": 424, "memory_total_mb": 8192, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 424, "memory_total_mb": 8192, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:48:09.818186Z", "memory_used_percent": 91, "memory_free_mb": 170, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 170, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:56:09.817424Z", "memory_used_percent": 98, "memory_free_mb": 94, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 94, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:52:09.813155Z", "cpu_5s_percent": 87, "cpu_1m_percent": 89, "cpu_5m_percent": 68, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 89, "cpu_5m_percent": 68, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:13:09.820303Z", "process": "crypto", "pid": 882, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "crypto", "pid": 882, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:30:09.823433Z", "process": "iosd", "pid": 4100, "crash_count_24h": 3, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "iosd", "pid": 4100, "crash_count_24h": 3, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:17:09.816658Z", "memory_used_percent": 97, "memory_free_mb": 56, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 56, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:05:09.822109Z", "process": "netconf", "pid": 3698, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 3698, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:28:09.819483Z", "memory_used_percent": 81, "memory_free_mb": 187, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 187, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:44:09.822962Z", "process": "crypto", "pid": 2186, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 2186, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:20:09.812205Z", "cpu_5s_percent": 88, "cpu_1m_percent": 92, "cpu_5m_percent": 88, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 92, "cpu_5m_percent": 88, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:28:09.815268Z", "cpu_5s_percent": 85, "cpu_1m_percent": 81, "cpu_5m_percent": 74, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 81, "cpu_5m_percent": 74, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:53:09.822836Z", "process": "snmpd", "pid": 1866, "crash_count_24h": 18, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 1866, "crash_count_24h": 18, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:39:09.820674Z", "process": "netconf", "pid": 3782, "crash_count_24h": 10, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "netconf", "pid": 3782, "crash_count_24h": 10, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:44:09.821178Z", "process": "iosd", "pid": 4525, "crash_count_24h": 4, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "iosd", "pid": 4525, "crash_count_24h": 4, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:56:09.815393Z", "cpu_5s_percent": 99, "cpu_1m_percent": 75, "cpu_5m_percent": 75, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 75, "cpu_5m_percent": 75, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:26:09.819272Z", "memory_used_percent": 81, "memory_free_mb": 218, "memory_total_mb": 1024, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 218, "memory_total_mb": 1024, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:08:09.819929Z", "memory_used_percent": 93, "memory_free_mb": 481, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 481, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:46:09.818498Z", "memory_used_percent": 94, "memory_free_mb": 63, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 63, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:31:09.820467Z", "process": "netconf", "pid": 2252, "crash_count_24h": 12, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2252, "crash_count_24h": 12, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:07:09.822516Z", "process": "netconf", "pid": 844, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 844, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:41:09.818558Z", "memory_used_percent": 80, "memory_free_mb": 219, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 219, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:00:09.820806Z", "process": "telemetry", "pid": 301, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 301, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:27:09.813551Z", "cpu_5s_percent": 92, "cpu_1m_percent": 90, "cpu_5m_percent": 70, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 90, "cpu_5m_percent": 70, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:56:09.821922Z", "process": "telemetry", "pid": 2028, "crash_count_24h": 14, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "telemetry", "pid": 2028, "crash_count_24h": 14, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:05:09.813090Z", "cpu_5s_percent": 87, "cpu_1m_percent": 86, "cpu_5m_percent": 87, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 86, "cpu_5m_percent": 87, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:33:09.819223Z", "memory_used_percent": 94, "memory_free_mb": 145, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 145, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:36:09.818577Z", "memory_used_percent": 96, "memory_free_mb": 276, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 276, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:39:09.816376Z", "memory_used_percent": 88, "memory_free_mb": 404, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 404, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:04:09.812966Z", "cpu_5s_percent": 89, "cpu_1m_percent": 79, "cpu_5m_percent": 70, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 79, "cpu_5m_percent": 70, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:50:09.815047Z", "cpu_5s_percent": 97, "cpu_1m_percent": 87, "cpu_5m_percent": 69, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 87, "cpu_5m_percent": 69, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:33:09.814015Z", "cpu_5s_percent": 85, "cpu_1m_percent": 80, "cpu_5m_percent": 88, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 80, "cpu_5m_percent": 88, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:32:09.822592Z", "process": "snmpd", "pid": 3796, "crash_count_24h": 21, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3796, "crash_count_24h": 21, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:32:09.817433Z", "memory_used_percent": 94, "memory_free_mb": 292, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 292, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:41:09.822526Z", "process": "telemetry", "pid": 2411, "crash_count_24h": 22, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "telemetry", "pid": 2411, "crash_count_24h": 22, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:16:09.822033Z", "process": "crypto", "pid": 2560, "crash_count_24h": 25, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 2560, "crash_count_24h": 25, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:55:09.821632Z", "process": "bgp", "pid": 4177, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 4177, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:45:09.820376Z", "process": "telemetry", "pid": 3818, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 3818, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:34:09.813630Z", "cpu_5s_percent": 95, "cpu_1m_percent": 78, "cpu_5m_percent": 91, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 78, "cpu_5m_percent": 91, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:56:09.814954Z", "cpu_5s_percent": 89, "cpu_1m_percent": 89, "cpu_5m_percent": 87, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 89, "cpu_5m_percent": 87, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:26:09.820076Z", "memory_used_percent": 89, "memory_free_mb": 468, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 468, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:49:09.823931Z", "process": "telemetry", "pid": 4744, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "telemetry", "pid": 4744, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:01:09.817107Z", "memory_used_percent": 82, "memory_free_mb": 435, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 435, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:59:09.822470Z", "process": "crypto", "pid": 2856, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 2856, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:02:09.823755Z", "process": "telemetry", "pid": 190, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 190, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:04:09.821323Z", "process": "bgp", "pid": 4058, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "bgp", "pid": 4058, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:37:09.818611Z", "memory_used_percent": 86, "memory_free_mb": 57, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 57, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:19:09.815508Z", "cpu_5s_percent": 96, "cpu_1m_percent": 79, "cpu_5m_percent": 88, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 79, "cpu_5m_percent": 88, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:25:09.816795Z", "memory_used_percent": 98, "memory_free_mb": 464, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 464, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:49:09.813826Z", "cpu_5s_percent": 97, "cpu_1m_percent": 89, "cpu_5m_percent": 81, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 89, "cpu_5m_percent": 81, "top_process": "CEF RP"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:47:09.817245Z", "memory_used_percent": 93, "memory_free_mb": 407, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 407, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:01:09.817628Z", "memory_used_percent": 84, "memory_free_mb": 328, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 328, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:20:09.819631Z", "memory_used_percent": 98, "memory_free_mb": 180, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 180, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:52:09.819849Z", "memory_used_percent": 94, "memory_free_mb": 168, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 168, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:28:09.823814Z", "process": "ospf", "pid": 4869, "crash_count_24h": 4, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 4869, "crash_count_24h": 4, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:13:09.821167Z", "process": "bgp", "pid": 2079, "crash_count_24h": 10, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 2079, "crash_count_24h": 10, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:21:09.816023Z", "cpu_5s_percent": 93, "cpu_1m_percent": 97, "cpu_5m_percent": 67, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 97, "cpu_5m_percent": 67, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:28:09.817020Z", "memory_used_percent": 92, "memory_free_mb": 64, "memory_total_mb": 1024, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 64, "memory_total_mb": 1024, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:47:09.818295Z", "memory_used_percent": 84, "memory_free_mb": 257, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 257, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:15:09.815168Z", "cpu_5s_percent": 90, "cpu_1m_percent": 94, "cpu_5m_percent": 78, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 94, "cpu_5m_percent": 78, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:27:09.824036Z", "process": "telemetry", "pid": 306, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "telemetry", "pid": 306, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:25:09.819591Z", "memory_used_percent": 87, "memory_free_mb": 386, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 386, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:03:09.822642Z", "process": "telemetry", "pid": 2478, "crash_count_24h": 15, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "telemetry", "pid": 2478, "crash_count_24h": 15, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:30:09.818242Z", "memory_used_percent": 85, "memory_free_mb": 155, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 155, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:42:09.817265Z", "memory_used_percent": 96, "memory_free_mb": 416, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 416, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:15:09.818949Z", "memory_used_percent": 97, "memory_free_mb": 87, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 87, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:42:09.821054Z", "process": "bgp", "pid": 3993, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 3993, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:43:09.816951Z", "memory_used_percent": 85, "memory_free_mb": 90, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 90, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:37:09.818529Z", "memory_used_percent": 87, "memory_free_mb": 436, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 436, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:26:09.817297Z", "memory_used_percent": 83, "memory_free_mb": 95, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 95, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:26:09.816428Z", "memory_used_percent": 96, "memory_free_mb": 143, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 143, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T13:26:09.820064Z", "memory_used_percent": 96, "memory_free_mb": 490, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 490, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:00:09.819233Z", "memory_used_percent": 88, "memory_free_mb": 273, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 273, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:12:09.818310Z", "memory_used_percent": 95, "memory_free_mb": 157, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 157, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T14:23:09.813739Z", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 94, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 94, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:17:09.821503Z", "process": "snmpd", "pid": 4257, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 4257, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T14:43:09.813759Z", "cpu_5s_percent": 89, "cpu_1m_percent": 85, "cpu_5m_percent": 87, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 85, "cpu_5m_percent": 87, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:49:09.818878Z", "memory_used_percent": 90, "memory_free_mb": 332, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 332, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:44:09.821655Z", "process": "telemetry", "pid": 1779, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "telemetry", "pid": 1779, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:52:09.815662Z", "cpu_5s_percent": 90, "cpu_1m_percent": 87, "cpu_5m_percent": 68, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 87, "cpu_5m_percent": 68, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:40:09.823744Z", "process": "telemetry", "pid": 3611, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 3611, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:36:09.814974Z", "cpu_5s_percent": 92, "cpu_1m_percent": 87, "cpu_5m_percent": 73, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 87, "cpu_5m_percent": 73, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:30:09.819469Z", "memory_used_percent": 91, "memory_free_mb": 307, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 307, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T07:52:09.817712Z", "memory_used_percent": 99, "memory_free_mb": 479, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 479, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:07:09.812391Z", "cpu_5s_percent": 93, "cpu_1m_percent": 80, "cpu_5m_percent": 82, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 80, "cpu_5m_percent": 82, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:05:09.818898Z", "memory_used_percent": 83, "memory_free_mb": 246, "memory_total_mb": 1024, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 246, "memory_total_mb": 1024, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T13:03:09.823301Z", "process": "ospf", "pid": 4697, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 4697, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:32:09.814512Z", "cpu_5s_percent": 85, "cpu_1m_percent": 81, "cpu_5m_percent": 84, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 81, "cpu_5m_percent": 84, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:05:09.814373Z", "cpu_5s_percent": 100, "cpu_1m_percent": 84, "cpu_5m_percent": 72, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 84, "cpu_5m_percent": 72, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "no ip http server", "no ip http secure-server"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:42:09.817255Z", "memory_used_percent": 84, "memory_free_mb": 101, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 101, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:14:09.819981Z", "memory_used_percent": 95, "memory_free_mb": 380, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 380, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T06:54:09.819961Z", "memory_used_percent": 83, "memory_free_mb": 259, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 259, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:29:09.814985Z", "cpu_5s_percent": 99, "cpu_1m_percent": 99, "cpu_5m_percent": 65, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 99, "cpu_5m_percent": 65, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:15:09.822952Z", "process": "netconf", "pid": 1625, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 1625, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T05:26:09.817583Z", "memory_used_percent": 88, "memory_free_mb": 244, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 244, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T08:03:09.819073Z", "memory_used_percent": 96, "memory_free_mb": 183, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 183, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:46:09.819459Z", "memory_used_percent": 91, "memory_free_mb": 380, "memory_total_mb": 1024, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 380, "memory_total_mb": 1024, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T04:56:09.823626Z", "process": "iosd", "pid": 1554, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "iosd", "pid": 1554, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:42:09.823311Z", "process": "crypto", "pid": 1334, "crash_count_24h": 3, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1334, "crash_count_24h": 3, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T05:27:09.813677Z", "cpu_5s_percent": 100, "cpu_1m_percent": 86, "cpu_5m_percent": 84, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 86, "cpu_5m_percent": 84, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T12:54:09.820890Z", "process": "netconf", "pid": 4835, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4835, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:57:09.812944Z", "cpu_5s_percent": 100, "cpu_1m_percent": 81, "cpu_5m_percent": 67, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 81, "cpu_5m_percent": 67, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T10:11:09.816138Z", "cpu_5s_percent": 89, "cpu_1m_percent": 91, "cpu_5m_percent": 91, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 91, "cpu_5m_percent": 91, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T07:04:09.817195Z", "memory_used_percent": 90, "memory_free_mb": 229, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 229, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T10:02:09.814079Z", "cpu_5s_percent": 95, "cpu_1m_percent": 84, "cpu_5m_percent": 82, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 84, "cpu_5m_percent": 82, "top_process": "SNMP ENGINE"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T09:22:09.814406Z", "cpu_5s_percent": 98, "cpu_1m_percent": 83, "cpu_5m_percent": 83, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 83, "cpu_5m_percent": 83, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:05:09.822879Z", "process": "crypto", "pid": 2639, "crash_count_24h": 8, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "crypto", "pid": 2639, "crash_count_24h": 8, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T08:38:09.820715Z", "process": "iosd", "pid": 3691, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "iosd", "pid": 3691, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:04:09.820054Z", "memory_used_percent": 97, "memory_free_mb": 486, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 486, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T09:15:09.813540Z", "cpu_5s_percent": 86, "cpu_1m_percent": 82, "cpu_5m_percent": 70, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 82, "cpu_5m_percent": 70, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T12:03:09.818370Z", "memory_used_percent": 88, "memory_free_mb": 157, "memory_total_mb": 4096, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 157, "memory_total_mb": 4096, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T11:06:09.817403Z", "memory_used_percent": 99, "memory_free_mb": 247, "memory_total_mb": 1024, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 247, "memory_total_mb": 1024, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-08T06:26:09.821099Z", "process": "bgp", "pid": 4349, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 4349, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-08T11:26:09.818908Z", "memory_used_percent": 82, "memory_free_mb": 458, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 458, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}