{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:09:24.028820Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:28:24.028002Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 43, "description": "Interface GigabitEthernet0/1 is flapping (43 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "flap_count_10m": 43}], "cli_fix": ["interface GigabitEthernet0/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:07:24.031764Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:11:24.029024Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:44:24.026708Z", "interface": "Ethernet1/1", "flap_count_10m": 18, "description": "Interface Ethernet1/1 is flapping (18 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 18}], "cli_fix": ["interface Ethernet1/1", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:43:24.027495Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 18, "description": "Interface GigabitEthernet1/0 is flapping (18 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 18}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:07:24.028300Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 32, "description": "Interface TenGigabitEthernet1/1 is flapping (32 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 32}], "cli_fix": ["interface TenGigabitEthernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:25:24.026758Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 18, "description": "Interface GigabitEthernet1/0 is flapping (18 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 18}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:34:24.032061Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:53:24.033084Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:07:24.032285Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:02:24.031822Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:36:24.025384Z", "interface": "Ethernet1/1", "flap_count_10m": 27, "description": "Interface Ethernet1/1 is flapping (27 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "Ethernet1/1", "flap_count_10m": 27}], "cli_fix": ["interface Ethernet1/1", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:49:24.030333Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:25:24.029516Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:27:24.026690Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 15, "description": "Interface TenGigabitEthernet1/1 is flapping (15 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 15}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:08:24.028452Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 7, "description": "Interface GigabitEthernet0/1 is flapping (7 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 7}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:37:24.027666Z", "interface": "Ethernet1/1", "flap_count_10m": 26, "description": "Interface Ethernet1/1 is flapping (26 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1", "flap_count_10m": 26}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:21:24.028707Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:50:24.030277Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:15:24.030218Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:07:24.028503Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 50, "description": "Interface GigabitEthernet1/0 is flapping (50 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 50}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:53:24.032253Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:07:24.029208Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:07:24.026715Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 15, "description": "Interface GigabitEthernet0/1 is flapping (15 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "flap_count_10m": 15}], "cli_fix": ["interface GigabitEthernet0/1", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:09:24.027660Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 24, "description": "Interface GigabitEthernet0/1 is flapping (24 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 24}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:13:24.029535Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:22:24.031265Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:06:24.027641Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 42, "description": "Interface GigabitEthernet0/0 is flapping (42 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "flap_count_10m": 42}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:59:24.027514Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 27, "description": "Interface GigabitEthernet0/0 is flapping (27 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 27}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:23:24.026764Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 6, "description": "Interface TenGigabitEthernet1/1 is flapping (6 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 6}], "cli_fix": ["interface TenGigabitEthernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:36:24.031520Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:50:24.032973Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:57:24.027028Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 37, "description": "Interface GigabitEthernet0/1 is flapping (37 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "flap_count_10m": 37}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:36:24.029882Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:56:24.030327Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:56:24.032594Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:37:24.029791Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:58:24.032488Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:37:24.027327Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 43, "description": "Interface GigabitEthernet0/0 is flapping (43 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "flap_count_10m": 43}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T12:01:24.029410Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:17:24.027272Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 25, "description": "Interface GigabitEthernet0/1 is flapping (25 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 25}], "cli_fix": ["interface GigabitEthernet0/1", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:18:24.029197Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:57:24.030982Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:31:24.027629Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 34, "description": "Interface GigabitEthernet0/0 is flapping (34 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 34}], "cli_fix": ["interface GigabitEthernet0/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:18:24.026553Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 33, "description": "Interface GigabitEthernet0/1 is flapping (33 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 33}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:49:24.029456Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:27:24.033123Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:03:24.025132Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 49, "description": "Interface GigabitEthernet1/0 is flapping (49 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 49}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:48:24.027596Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 7, "description": "Interface GigabitEthernet0/1 is flapping (7 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 7}], "cli_fix": ["interface GigabitEthernet0/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:15:24.031464Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:00:24.032513Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:13:24.025114Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 47, "description": "Interface GigabitEthernet1/0 is flapping (47 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 47}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:35:24.030115Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:23:24.028958Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:40:24.030817Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:25:24.033047Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:34:24.027102Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 13, "description": "Interface GigabitEthernet1/0 is flapping (13 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 13}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:25:24.029697Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:01:24.030747Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:26:24.031108Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:19:24.029723Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:58:24.029888Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:54:24.027003Z", "interface": "Ethernet1/1", "flap_count_10m": 34, "description": "Interface Ethernet1/1 is flapping (34 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 34}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:56:24.027728Z", "interface": "Ethernet1/1", "flap_count_10m": 12, "description": "Interface Ethernet1/1 is flapping (12 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 12}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:41:24.027840Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 42, "description": "Interface GigabitEthernet0/0 is flapping (42 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 42}], "cli_fix": ["interface GigabitEthernet0/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:26:24.032477Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:52:24.030270Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:29:24.028737Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:07:24.025212Z", "interface": "Ethernet1/1", "flap_count_10m": 11, "description": "Interface Ethernet1/1 is flapping (11 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 11}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:02:24.025234Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 50, "description": "Interface GigabitEthernet0/0 is flapping (50 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 50}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:57:24.032365Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:58:24.026671Z", "interface": "Ethernet1/1", "flap_count_10m": 17, "description": "Interface Ethernet1/1 is flapping (17 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1", "flap_count_10m": 17}], "cli_fix": ["interface Ethernet1/1", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:23:24.027115Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 23, "description": "Interface GigabitEthernet0/1 is flapping (23 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 23}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:07:24.029434Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:32:24.029082Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:33:24.031090Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:51:24.029036Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:33:24.027685Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 23, "description": "Interface GigabitEthernet0/1 is flapping (23 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 23}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T12:04:24.032781Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T12:04:24.029909Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:49:24.030321Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:39:24.028321Z", "interface": "Ethernet1/1", "flap_count_10m": 48, "description": "Interface Ethernet1/1 is flapping (48 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 48}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:23:24.032656Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:52:24.027196Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 27, "description": "Interface TenGigabitEthernet1/1 is flapping (27 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 27}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:39:24.030290Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:10:24.032712Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:11:24.025247Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 46, "description": "Interface GigabitEthernet0/0 is flapping (46 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 46}], "cli_fix": ["interface GigabitEthernet0/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:09:24.025146Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 15, "description": "Interface GigabitEthernet1/0 is flapping (15 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 15}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:16:24.031405Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:34:24.032724Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:01:24.031548Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:43:24.028784Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:17:24.032377Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:56:24.032010Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:37:24.032621Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:05:24.032390Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:23:24.030344Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:09:24.029164Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:21:24.031373Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:54:24.027066Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 50, "description": "Interface GigabitEthernet0/1 is flapping (50 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 50}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:08:24.027433Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 23, "description": "Interface GigabitEthernet1/0 is flapping (23 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 23}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:41:24.028790Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:48:24.026843Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 41, "description": "Interface GigabitEthernet0/1 is flapping (41 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 41}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:10:24.026734Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 7, "description": "Interface GigabitEthernet0/1 is flapping (7 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 7}], "cli_fix": ["interface GigabitEthernet0/1", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:05:24.028368Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 43, "description": "Interface GigabitEthernet0/1 is flapping (43 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "flap_count_10m": 43}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:06:24.029947Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:28:24.029313Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:16:24.032961Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:14:24.029087Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:49:24.028842Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:28:24.032305Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:41:24.032573Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:50:24.027783Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 37, "description": "Interface GigabitEthernet0/1 is flapping (37 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 37}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:31:24.031008Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:20:24.029774Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:10:24.027771Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 44, "description": "Interface GigabitEthernet1/0 is flapping (44 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 44}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:28:24.031114Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:05:24.029065Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:59:24.030827Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:47:24.026966Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 5, "description": "Interface GigabitEthernet0/1 is flapping (5 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 5}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:51:24.030161Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:45:24.028515Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 46, "description": "Interface GigabitEthernet0/1 is flapping (46 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 46}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:58:24.029602Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:07:24.028808Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:39:24.025401Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 42, "description": "Interface GigabitEthernet0/0 is flapping (42 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 42}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:12:24.032580Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:13:24.026752Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 30, "description": "Interface GigabitEthernet1/0 is flapping (30 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 30}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:30:24.028375Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 5, "description": "Interface TenGigabitEthernet1/1 is flapping (5 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 5}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:33:24.027541Z", "interface": "Ethernet1/1", "flap_count_10m": 35, "description": "Interface Ethernet1/1 is flapping (35 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 35}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:44:24.028917Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:33:24.032157Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:28:24.032371Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:50:24.027414Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 37, "description": "Interface GigabitEthernet0/0 is flapping (37 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "flap_count_10m": 37}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:12:24.026783Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 25, "description": "Interface TenGigabitEthernet1/1 is flapping (25 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 25}], "cli_fix": ["interface TenGigabitEthernet1/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:11:24.031052Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:43:24.027635Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 47, "description": "Interface TenGigabitEthernet1/1 is flapping (47 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 47}], "cli_fix": ["interface TenGigabitEthernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:45:24.027134Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 32, "description": "Interface GigabitEthernet1/0 is flapping (32 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 32}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:39:24.031392Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:28:24.028464Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 6, "description": "Interface GigabitEthernet0/0 is flapping (6 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 6}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:56:24.032110Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:31:24.027302Z", "interface": "Ethernet1/1", "flap_count_10m": 28, "description": "Interface Ethernet1/1 is flapping (28 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 28}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:29:24.030995Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:52:24.031486Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:45:24.032761Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:08:24.029660Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:21:24.026777Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 10, "description": "Interface TenGigabitEthernet1/1 is flapping (10 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 10}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:35:24.029574Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:12:24.026678Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 14, "description": "Interface GigabitEthernet0/0 is flapping (14 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 14}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:38:24.030338Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:47:24.032520Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:35:24.029860Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:50:24.031187Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:30:24.032004Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:24:24.029877Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:54:24.032600Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:20:24.030454Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:16:24.028490Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 8, "description": "Interface GigabitEthernet1/0 is flapping (8 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 8}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:19:24.027266Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 39, "description": "Interface GigabitEthernet0/0 is flapping (39 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 39}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:55:24.032955Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:27:24.026823Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 21, "description": "Interface GigabitEthernet0/0 is flapping (21 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 21}], "cli_fix": ["interface GigabitEthernet0/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:15:24.029712Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:00:24.033145Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:44:24.029448Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:40:24.029262Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:23:24.029899Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:41:24.027590Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 8, "description": "Interface GigabitEthernet1/0 is flapping (8 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 8}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:25:24.032144Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:50:24.031042Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:27:24.032016Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:30:24.026727Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 32, "description": "Interface GigabitEthernet0/1 is flapping (32 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 32}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:33:24.027752Z", "interface": "Ethernet1/1", "flap_count_10m": 10, "description": "Interface Ethernet1/1 is flapping (10 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1", "flap_count_10m": 10}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:17:24.030789Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:05:24.031542Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:52:24.027184Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 32, "description": "Interface GigabitEthernet1/0 is flapping (32 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 32}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:49:24.032177Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:01:24.030510Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:41:24.028314Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 45, "description": "Interface TenGigabitEthernet1/1 is flapping (45 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 45}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T12:04:24.031751Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:18:24.030413Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:28:24.026721Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 41, "description": "Interface TenGigabitEthernet1/1 is flapping (41 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 41}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:34:24.029285Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:26:24.031470Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:28:24.028870Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:34:24.028653Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:00:24.026991Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 26, "description": "Interface GigabitEthernet0/1 is flapping (26 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 26}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:11:24.033117Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:34:24.025268Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 27, "description": "Interface GigabitEthernet0/1 is flapping (27 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 27}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:06:24.030295Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:58:24.033139Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:50:24.027040Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 32, "description": "Interface GigabitEthernet1/0 is flapping (32 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 32}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:50:24.030263Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:04:24.026605Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 42, "description": "Interface GigabitEthernet1/0 is flapping (42 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 42}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:05:24.026909Z", "interface": "Ethernet1/1", "flap_count_10m": 40, "description": "Interface Ethernet1/1 is flapping (40 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "Ethernet1/1", "flap_count_10m": 40}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:20:24.030418Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:22:24.027703Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 39, "description": "Interface GigabitEthernet1/0 is flapping (39 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 39}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T12:03:24.026665Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 34, "description": "Interface GigabitEthernet0/0 is flapping (34 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 34}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:53:24.028749Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:14:24.033072Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:54:24.030006Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:56:24.028359Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 8, "description": "Interface TenGigabitEthernet1/1 is flapping (8 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 8}], "cli_fix": ["interface TenGigabitEthernet1/1", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:26:24.029872Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:39:24.029586Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:51:24.028349Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 37, "description": "Interface GigabitEthernet0/0 is flapping (37 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 37}], "cli_fix": ["interface GigabitEthernet0/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:38:24.025513Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 29, "description": "Interface GigabitEthernet0/1 is flapping (29 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 29}], "cli_fix": ["interface GigabitEthernet0/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:08:24.031686Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:36:24.029381Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:39:24.025197Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 23, "description": "Interface GigabitEthernet0/0 is flapping (23 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "flap_count_10m": 23}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:29:24.029634Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:22:24.032646Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:24:24.032124Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:49:24.030944Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:32:24.030563Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:09:24.032686Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:20:24.030612Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:51:24.027945Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 35, "description": "Interface GigabitEthernet1/0 is flapping (35 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 35}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:39:24.031398Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:29:24.026972Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 7, "description": "Interface GigabitEthernet0/0 is flapping (7 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 7}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:09:24.028432Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 19, "description": "Interface TenGigabitEthernet1/1 is flapping (19 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 19}], "cli_fix": ["interface TenGigabitEthernet1/1", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:05:24.027128Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 26, "description": "Interface GigabitEthernet0/0 is flapping (26 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 26}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:56:24.028934Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:26:24.032668Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:11:24.032191Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:52:24.032818Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:30:24.027617Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 45, "description": "Interface GigabitEthernet1/0 is flapping (45 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 45}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:02:24.029718Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:26:24.028639Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:49:24.029174Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:45:24.029831Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:54:24.032673Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:28:24.028026Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 42, "description": "Interface GigabitEthernet0/0 is flapping (42 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 42}], "cli_fix": ["interface GigabitEthernet0/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:35:24.030376Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:06:24.029246Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:04:24.031912Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:49:24.029508Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:20:24.030738Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:41:24.032345Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:43:24.032561Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:32:24.028695Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:38:24.029138Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:46:24.026890Z", "interface": "Ethernet1/1", "flap_count_10m": 45, "description": "Interface Ethernet1/1 is flapping (45 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1", "flap_count_10m": 45}], "cli_fix": ["interface Ethernet1/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:41:24.033078Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:47:24.031656Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:00:24.029400Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:53:24.031924Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:32:24.029568Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:09:24.032586Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:25:24.031298Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:11:24.032807Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:37:24.032613Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:44:24.025254Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 32, "description": "Interface GigabitEthernet1/0 is flapping (32 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 32}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:20:24.029706Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:10:24.027109Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 44, "description": "Interface GigabitEthernet1/0 is flapping (44 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 44}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:38:24.030284Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:55:24.031231Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:11:24.031138Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:48:24.029366Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T12:00:24.027278Z", "interface": "Ethernet1/1", "flap_count_10m": 32, "description": "Interface Ethernet1/1 is flapping (32 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 32}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:09:24.033016Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:59:24.033060Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:58:24.030225Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:03:24.031668Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:43:24.031498Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:45:24.026868Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 21, "description": "Interface GigabitEthernet1/0 is flapping (21 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 21}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:08:24.028796Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:57:24.027995Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 48, "description": "Interface GigabitEthernet1/0 is flapping (48 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 48}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:42:24.033151Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:10:24.030071Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:09:24.029966Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:42:24.031719Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:05:24.026997Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 11, "description": "Interface GigabitEthernet1/0 is flapping (11 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 11}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:37:24.032567Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:07:24.030473Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:46:24.025378Z", "interface": "Ethernet1/1", "flap_count_10m": 35, "description": "Interface Ethernet1/1 is flapping (35 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 35}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:32:24.032271Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:20:24.027078Z", "interface": "Ethernet1/1", "flap_count_10m": 44, "description": "Interface Ethernet1/1 is flapping (44 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 44}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:30:24.026696Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 5, "description": "Interface GigabitEthernet0/0 is flapping (5 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 5}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:11:24.027697Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 13, "description": "Interface GigabitEthernet0/0 is flapping (13 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "flap_count_10m": 13}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:42:24.026684Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 26, "description": "Interface TenGigabitEthernet1/1 is flapping (26 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 26}], "cli_fix": ["interface TenGigabitEthernet1/1", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:46:24.026657Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 11, "description": "Interface GigabitEthernet1/0 is flapping (11 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 11}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:43:24.026577Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 8, "description": "Interface TenGigabitEthernet1/1 is flapping (8 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 8}], "cli_fix": ["interface TenGigabitEthernet1/1", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:01:24.027932Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 11, "description": "Interface TenGigabitEthernet1/1 is flapping (11 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 11}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:20:24.031725Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:02:24.030176Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:46:24.030636Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:17:24.032482Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:21:24.031559Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:26:24.027604Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 45, "description": "Interface TenGigabitEthernet1/1 is flapping (45 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 45}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:21:24.030778Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:16:24.032185Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:23:24.026849Z", "interface": "Ethernet1/1", "flap_count_10m": 7, "description": "Interface Ethernet1/1 is flapping (7 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 7}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:37:24.030989Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:39:24.029257Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:59:24.027420Z", "interface": "Ethernet1/1", "flap_count_10m": 17, "description": "Interface Ethernet1/1 is flapping (17 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 17}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:57:24.028659Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:44:24.025282Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 40, "description": "Interface GigabitEthernet0/1 is flapping (40 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "flap_count_10m": 40}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:47:24.028459Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 31, "description": "Interface GigabitEthernet0/0 is flapping (31 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 31}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:07:24.031638Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:26:24.025538Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 33, "description": "Interface GigabitEthernet0/1 is flapping (33 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 33}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:01:24.026959Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 21, "description": "Interface GigabitEthernet0/1 is flapping (21 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 21}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:33:24.027284Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 33, "description": "Interface GigabitEthernet1/0 is flapping (33 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 33}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:28:24.029270Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:01:24.027367Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 48, "description": "Interface TenGigabitEthernet1/1 is flapping (48 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 48}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:44:24.029495Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:05:24.032265Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:07:24.027146Z", "interface": "Ethernet1/1", "flap_count_10m": 13, "description": "Interface Ethernet1/1 is flapping (13 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 13}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:45:24.032943Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:19:24.028340Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 38, "description": "Interface GigabitEthernet0/1 is flapping (38 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "flap_count_10m": 38}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:42:24.031919Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:24:24.031843Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:32:24.027740Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 39, "description": "Interface GigabitEthernet0/0 is flapping (39 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 39}], "cli_fix": ["interface GigabitEthernet0/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:33:24.031200Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:56:24.026798Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 35, "description": "Interface TenGigabitEthernet1/1 is flapping (35 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 35}], "cli_fix": ["interface TenGigabitEthernet1/1", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:21:24.025275Z", "interface": "Ethernet1/1", "flap_count_10m": 24, "description": "Interface Ethernet1/1 is flapping (24 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1", "flap_count_10m": 24}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:40:24.029800Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:39:24.026643Z", "interface": "Ethernet1/1", "flap_count_10m": 33, "description": "Interface Ethernet1/1 is flapping (33 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 33}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:40:24.029013Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:30:24.028743Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:24:24.027484Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 18, "description": "Interface TenGigabitEthernet1/1 is flapping (18 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 18}], "cli_fix": ["interface TenGigabitEthernet1/1", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:41:24.027394Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 32, "description": "Interface GigabitEthernet0/0 is flapping (32 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 32}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:27:24.031569Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:49:24.031993Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T12:02:24.032446Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:15:24.032222Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:06:24.026862Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 7, "description": "Interface GigabitEthernet1/0 is flapping (7 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 7}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:40:24.027809Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 33, "description": "Interface GigabitEthernet1/0 is flapping (33 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 33}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:38:24.029613Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:16:24.027121Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 19, "description": "Interface GigabitEthernet1/0 is flapping (19 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 19}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:39:24.030135Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:02:24.027140Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 8, "description": "Interface TenGigabitEthernet1/1 is flapping (8 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 8}], "cli_fix": ["interface TenGigabitEthernet1/1", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:08:24.030627Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:43:24.030016Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:15:24.028411Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 7, "description": "Interface GigabitEthernet0/1 is flapping (7 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "flap_count_10m": 7}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:10:24.027190Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 49, "description": "Interface TenGigabitEthernet1/1 is flapping (49 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 49}], "cli_fix": ["interface TenGigabitEthernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:55:24.025411Z", "interface": "Ethernet1/1", "flap_count_10m": 27, "description": "Interface Ethernet1/1 is flapping (27 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1", "flap_count_10m": 27}], "cli_fix": ["interface Ethernet1/1", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:20:24.028386Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 42, "description": "Interface TenGigabitEthernet1/1 is flapping (42 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 42}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:08:24.032399Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:12:24.031174Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:29:24.031999Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:45:24.032749Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:39:24.029388Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:33:24.025448Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 22, "description": "Interface GigabitEthernet1/0 is flapping (22 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 22}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:28:24.029954Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:48:24.032425Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T12:03:24.031102Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:07:24.031096Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:21:24.029766Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:38:24.031803Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:24:24.029995Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:06:24.030059Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:30:24.031695Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:06:24.031869Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:12:24.029937Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:41:24.029342Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:57:24.030396Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:57:24.033031Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:23:24.029597Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:53:24.030718Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:26:24.029076Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:12:24.027451Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 9, "description": "Interface GigabitEthernet0/0 is flapping (9 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 9}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:42:24.030199Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:33:24.032094Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:09:24.028894Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:29:24.028702Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:24:24.026836Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 14, "description": "Interface GigabitEthernet1/0 is flapping (14 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 14}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:52:24.032923Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:48:24.031319Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:10:24.032896Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:37:24.028952Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:47:24.031650Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:06:24.030251Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:05:24.030675Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:13:24.032150Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:17:24.031680Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:05:24.028687Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:27:24.029169Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:19:24.032089Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:28:24.029059Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:29:24.028995Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:41:24.029928Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:10:24.031963Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:34:24.028646Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:08:24.030302Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:19:24.029405Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:27:24.027457Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 30, "description": "Interface GigabitEthernet0/1 is flapping (30 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "flap_count_10m": 30}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:43:24.028713Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:34:24.029747Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:39:24.029324Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:42:24.030187Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:09:24.031212Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:25:24.031023Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:35:24.031133Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:07:24.027758Z", "interface": "Ethernet1/1", "flap_count_10m": 37, "description": "Interface Ethernet1/1 is flapping (37 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 37}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:58:24.032040Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:22:24.031036Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:05:24.029918Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:21:24.030530Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:38:24.030109Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:16:24.026590Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 45, "description": "Interface TenGigabitEthernet1/1 is flapping (45 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 45}], "cli_fix": ["interface TenGigabitEthernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:10:24.032046Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:04:24.031237Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:13:24.028876Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:45:24.029394Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:16:24.031127Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:07:24.029649Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:15:24.028405Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 40, "description": "Interface TenGigabitEthernet1/1 is flapping (40 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 40}], "cli_fix": ["interface TenGigabitEthernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:43:24.026612Z", "interface": "Ethernet1/1", "flap_count_10m": 11, "description": "Interface Ethernet1/1 is flapping (11 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 11}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:49:24.026531Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 49, "description": "Interface GigabitEthernet0/1 is flapping (49 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 49}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:08:24.030389Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:11:24.027716Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 29, "description": "Interface GigabitEthernet0/0 is flapping (29 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "flap_count_10m": 29}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:19:24.032607Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:25:24.027338Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 48, "description": "Interface GigabitEthernet0/1 is flapping (48 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "flap_count_10m": 48}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:26:24.032116Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:16:24.032028Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:16:24.029866Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:16:24.032978Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:17:24.026829Z", "interface": "Ethernet1/1", "flap_count_10m": 38, "description": "Interface Ethernet1/1 is flapping (38 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 38}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:09:24.028327Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 44, "description": "Interface GigabitEthernet1/0 is flapping (44 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 44}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:28:24.031744Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:41:24.031411Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:47:24.030618Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:08:24.027159Z", "interface": "Ethernet1/1", "flap_count_10m": 40, "description": "Interface Ethernet1/1 is flapping (40 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 40}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:19:24.028831Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:41:24.029356Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:32:24.027882Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 6, "description": "Interface GigabitEthernet1/0 is flapping (6 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 6}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:48:24.026902Z", "interface": "Ethernet1/1", "flap_count_10m": 18, "description": "Interface Ethernet1/1 is flapping (18 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 18}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:45:24.033099Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:28:24.029561Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:57:24.030257Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:50:24.028977Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:17:24.032967Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:15:24.030168Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:58:24.031976Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:49:24.031536Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:45:24.027152Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 13, "description": "Interface GigabitEthernet0/1 is flapping (13 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 13}], "cli_fix": ["interface GigabitEthernet0/1", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:06:24.026636Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 23, "description": "Interface GigabitEthernet1/0 is flapping (23 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 23}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:34:24.025342Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 26, "description": "Interface GigabitEthernet1/0 is flapping (26 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 26}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:22:24.029110Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:42:24.026619Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 23, "description": "Interface GigabitEthernet0/0 is flapping (23 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 23}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:40:24.026947Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 42, "description": "Interface TenGigabitEthernet1/1 is flapping (42 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 42}], "cli_fix": ["interface TenGigabitEthernet1/1", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:44:24.030238Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:11:24.031906Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:31:24.025261Z", "interface": "Ethernet1/1", "flap_count_10m": 34, "description": "Interface Ethernet1/1 is flapping (34 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 34}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:17:24.026928Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 50, "description": "Interface TenGigabitEthernet1/1 is flapping (50 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 50}], "cli_fix": ["interface TenGigabitEthernet1/1", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:58:24.029473Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:55:24.026771Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 40, "description": "Interface GigabitEthernet0/0 is flapping (40 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 40}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:03:24.027520Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 40, "description": "Interface GigabitEthernet0/0 is flapping (40 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "flap_count_10m": 40}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:27:24.029180Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:03:24.030357Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:34:24.027903Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 48, "description": "Interface GigabitEthernet0/1 is flapping (48 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "flap_count_10m": 48}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:44:24.031367Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:17:24.031769Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:34:24.030730Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:05:24.031554Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:26:24.028484Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 7, "description": "Interface GigabitEthernet1/0 is flapping (7 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 7}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:29:24.033040Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:45:24.030497Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:22:24.031882Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:34:24.032070Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:15:24.027889Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 36, "description": "Interface GigabitEthernet0/1 is flapping (36 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "flap_count_10m": 36}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:37:24.030491Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:01:24.030684Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:00:24.032130Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:31:24.027865Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 20, "description": "Interface GigabitEthernet1/0 is flapping (20 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 20}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:39:24.031631Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:18:24.032796Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:30:24.031898Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:58:24.029121Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:53:24.030407Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:51:24.029214Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:14:24.031304Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:34:24.032293Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:43:24.029960Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:02:24.028940Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:45:24.027846Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 12, "description": "Interface GigabitEthernet0/1 is flapping (12 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 12}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:31:24.028280Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 9, "description": "Interface GigabitEthernet0/1 is flapping (9 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 9}], "cli_fix": ["interface GigabitEthernet0/1", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:10:24.026584Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 20, "description": "Interface TenGigabitEthernet1/1 is flapping (20 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 20}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:13:24.032698Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:10:24.025371Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 14, "description": "Interface GigabitEthernet0/1 is flapping (14 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 14}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:17:24.029780Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:07:24.030643Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:39:24.031271Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:06:24.030000Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:30:24.027407Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 40, "description": "Interface GigabitEthernet0/1 is flapping (40 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 40}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:57:24.032431Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:19:24.030582Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:57:24.030121Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:05:24.030557Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:57:24.031625Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:06:24.030957Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:24:24.029988Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:42:24.028971Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:13:24.031195Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:33:24.030692Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:46:24.032718Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:53:24.030661Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:14:24.029580Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:39:24.027084Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 48, "description": "Interface GigabitEthernet1/0 is flapping (48 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 48}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:08:24.031121Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:49:24.032323Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:38:24.025302Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 29, "description": "Interface GigabitEthernet0/1 is flapping (29 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 29}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T12:01:24.032163Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:41:24.026740Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 27, "description": "Interface GigabitEthernet0/0 is flapping (27 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 27}], "cli_fix": ["interface GigabitEthernet0/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:58:24.032937Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:32:24.029552Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:33:24.031849Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:12:24.028964Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:10:24.025296Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 10, "description": "Interface GigabitEthernet0/1 is flapping (10 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 10}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:58:24.026563Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 50, "description": "Interface GigabitEthernet1/0 is flapping (50 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 50}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:27:24.026630Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 42, "description": "Interface GigabitEthernet1/0 is flapping (42 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 42}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:42:24.027439Z", "interface": "Ethernet1/1", "flap_count_10m": 37, "description": "Interface Ethernet1/1 is flapping (37 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 37}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:28:24.032662Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:40:24.032529Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:53:24.029251Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:11:24.029202Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:52:24.026856Z", "interface": "Ethernet1/1", "flap_count_10m": 47, "description": "Interface Ethernet1/1 is flapping (47 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 47}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:00:24.026896Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 35, "description": "Interface GigabitEthernet0/0 is flapping (35 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 35}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:57:24.028905Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:08:24.031713Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:45:24.028772Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:53:24.029810Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:40:24.026883Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 26, "description": "Interface GigabitEthernet0/1 is flapping (26 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 26}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:16:24.029127Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:26:24.025241Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 40, "description": "Interface GigabitEthernet0/0 is flapping (40 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 40}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:17:24.027314Z", "interface": "Ethernet1/1", "flap_count_10m": 9, "description": "Interface Ethernet1/1 is flapping (9 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 9}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:27:24.031419Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:43:24.029541Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:36:24.029292Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:39:24.031757Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:01:24.028268Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 15, "description": "Interface GigabitEthernet0/0 is flapping (15 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "flap_count_10m": 15}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:31:24.030571Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:32:24.027296Z", "interface": "Ethernet1/1", "flap_count_10m": 10, "description": "Interface Ethernet1/1 is flapping (10 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 10}], "cli_fix": ["interface Ethernet1/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:32:24.032209Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:41:24.032022Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:06:24.031528Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:53:24.028984Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:23:24.030758Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:56:24.027547Z", "interface": "Ethernet1/1", "flap_count_10m": 48, "description": "Interface Ethernet1/1 is flapping (48 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 48}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:32:24.029686Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:47:24.031084Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:35:24.032233Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:25:24.027218Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 8, "description": "Interface GigabitEthernet0/1 is flapping (8 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "flap_count_10m": 8}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:56:24.030519Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:02:24.028019Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 16, "description": "Interface GigabitEthernet1/0 is flapping (16 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 16}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:26:24.030104Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:25:24.032860Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:45:24.029761Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:00:24.032832Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:48:24.025526Z", "interface": "Ethernet1/1", "flap_count_10m": 8, "description": "Interface Ethernet1/1 is flapping (8 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "Ethernet1/1", "flap_count_10m": 8}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:15:24.033000Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:51:24.031863Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:16:24.030155Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:27:24.031505Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:04:24.031452Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:45:24.027046Z", "interface": "Ethernet1/1", "flap_count_10m": 7, "description": "Interface Ethernet1/1 is flapping (7 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1", "flap_count_10m": 7}], "cli_fix": ["interface Ethernet1/1", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:29:24.027072Z", "interface": "Ethernet1/1", "flap_count_10m": 26, "description": "Interface Ethernet1/1 is flapping (26 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 26}], "cli_fix": ["interface Ethernet1/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:46:24.031016Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:39:24.028928Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:47:24.027679Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 32, "description": "Interface GigabitEthernet1/0 is flapping (32 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 32}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:43:24.028521Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 42, "description": "Interface GigabitEthernet1/0 is flapping (42 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 42}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:11:24.031613Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:09:24.027096Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 47, "description": "Interface TenGigabitEthernet1/1 is flapping (47 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 47}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:13:24.027610Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 8, "description": "Interface TenGigabitEthernet1/1 is flapping (8 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 8}], "cli_fix": ["interface TenGigabitEthernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:33:24.027445Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 15, "description": "Interface GigabitEthernet1/0 is flapping (15 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 15}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:26:24.029423Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:37:24.028442Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 31, "description": "Interface GigabitEthernet0/0 is flapping (31 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 31}], "cli_fix": ["interface GigabitEthernet0/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:19:24.027344Z", "interface": "Ethernet1/1", "flap_count_10m": 32, "description": "Interface Ethernet1/1 is flapping (32 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 32}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:08:24.029152Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:28:24.032984Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:23:24.030402Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:08:24.030769Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:07:24.028497Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 17, "description": "Interface GigabitEthernet0/1 is flapping (17 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 17}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:13:24.030243Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:48:24.030443Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:48:24.029691Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:44:24.026940Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 33, "description": "Interface GigabitEthernet0/1 is flapping (33 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 33}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:26:24.026979Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 26, "description": "Interface GigabitEthernet1/0 is flapping (26 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 26}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:20:24.030041Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:53:24.028754Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:32:24.027894Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 11, "description": "Interface GigabitEthernet1/0 is flapping (11 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 11}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:09:24.028260Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 26, "description": "Interface GigabitEthernet0/1 is flapping (26 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 26}], "cli_fix": ["interface GigabitEthernet0/1", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:23:24.029030Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:42:24.029674Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:20:24.025390Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 6, "description": "Interface TenGigabitEthernet1/1 is flapping (6 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 6}], "cli_fix": ["interface TenGigabitEthernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:50:24.029070Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:24:24.031339Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:12:24.029132Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:52:24.032630Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:09:24.031361Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:33:24.029007Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:31:24.029019Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:05:24.027351Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 23, "description": "Interface GigabitEthernet0/1 is flapping (23 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "flap_count_10m": 23}], "cli_fix": ["interface GigabitEthernet0/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:37:24.032755Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:05:24.027240Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 36, "description": "Interface GigabitEthernet0/0 is flapping (36 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 36}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:27:24.027746Z", "interface": "Ethernet1/1", "flap_count_10m": 10, "description": "Interface Ethernet1/1 is flapping (10 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 10}], "cli_fix": ["interface Ethernet1/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:46:24.032215Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:20:24.027178Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 28, "description": "Interface TenGigabitEthernet1/1 is flapping (28 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 28}], "cli_fix": ["interface TenGigabitEthernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:54:24.029279Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:23:24.027951Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 47, "description": "Interface GigabitEthernet1/0 is flapping (47 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 47}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:09:24.031931Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:04:24.032451Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:32:24.028765Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:59:24.025361Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 39, "description": "Interface TenGigabitEthernet1/1 is flapping (39 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 39}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:14:24.027090Z", "interface": "Ethernet1/1", "flap_count_10m": 23, "description": "Interface Ethernet1/1 is flapping (23 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 23}], "cli_fix": ["interface Ethernet1/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:13:24.032839Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:58:24.029591Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:10:24.032459Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:51:24.032735Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T12:03:24.025331Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 16, "description": "Interface GigabitEthernet1/0 is flapping (16 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 16}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:13:24.027171Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 39, "description": "Interface GigabitEthernet0/0 is flapping (39 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 39}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:57:24.025498Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 37, "description": "Interface TenGigabitEthernet1/1 is flapping (37 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 37}], "cli_fix": ["interface TenGigabitEthernet1/1", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:12:24.027463Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 32, "description": "Interface GigabitEthernet0/1 is flapping (32 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "flap_count_10m": 32}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:13:24.028417Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 36, "description": "Interface GigabitEthernet1/0 is flapping (36 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 36}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:48:24.030709Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:00:24.027022Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 46, "description": "Interface TenGigabitEthernet1/1 is flapping (46 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 46}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:52:24.032692Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:30:24.027710Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 38, "description": "Interface GigabitEthernet1/0 is flapping (38 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 38}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:09:24.029240Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:04:24.029001Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:04:24.031168Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:27:24.028899Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:20:24.028989Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:13:24.030601Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T12:02:24.027388Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 33, "description": "Interface GigabitEthernet1/0 is flapping (33 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 33}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:12:24.027989Z", "interface": "Ethernet1/1", "flap_count_10m": 40, "description": "Interface Ethernet1/1 is flapping (40 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 40}], "cli_fix": ["interface Ethernet1/1", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:28:24.029839Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:36:24.025486Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 5, "description": "Interface TenGigabitEthernet1/1 is flapping (5 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 5}], "cli_fix": ["interface TenGigabitEthernet1/1", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:26:24.030424Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:36:24.031218Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:55:24.032902Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:47:24.029300Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:21:24.029608Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:35:24.030430Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:26:24.026746Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 35, "description": "Interface TenGigabitEthernet1/1 is flapping (35 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 35}], "cli_fix": ["interface TenGigabitEthernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:43:24.028837Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:17:24.032537Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:38:24.027957Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 31, "description": "Interface GigabitEthernet0/0 is flapping (31 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "flap_count_10m": 31}], "cli_fix": ["interface GigabitEthernet0/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T12:04:24.030182Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:33:24.027228Z", "interface": "Ethernet1/1", "flap_count_10m": 17, "description": "Interface Ethernet1/1 is flapping (17 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 17}], "cli_fix": ["interface Ethernet1/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:39:24.031857Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:27:24.031429Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:06:24.029318Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:58:24.031385Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:33:24.028478Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 23, "description": "Interface TenGigabitEthernet1/1 is flapping (23 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 23}], "cli_fix": ["interface TenGigabitEthernet1/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:35:24.032705Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:57:24.032681Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:38:24.031245Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:35:24.031644Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:15:24.032137Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:54:24.027822Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 20, "description": "Interface GigabitEthernet0/1 is flapping (20 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 20}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:11:24.027505Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 15, "description": "Interface GigabitEthernet0/1 is flapping (15 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 15}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:59:24.031253Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:12:24.025353Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 24, "description": "Interface GigabitEthernet0/0 is flapping (24 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 24}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:43:24.033132Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:38:24.030460Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:33:24.028912Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:22:24.032932Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:40:24.027976Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 35, "description": "Interface GigabitEthernet0/0 is flapping (35 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 35}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:40:24.027378Z", "interface": "Ethernet1/1", "flap_count_10m": 20, "description": "Interface Ethernet1/1 is flapping (20 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "Ethernet1/1", "flap_count_10m": 20}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:04:24.029307Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:35:24.027792Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 49, "description": "Interface TenGigabitEthernet1/1 is flapping (49 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 49}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:28:24.030968Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:32:24.029680Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T12:03:24.032949Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:30:24.032874Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:15:24.032259Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:01:24.028922Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:36:24.027916Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 33, "description": "Interface GigabitEthernet0/0 is flapping (33 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 33}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:02:24.029622Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:06:24.027828Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 46, "description": "Interface TenGigabitEthernet1/1 is flapping (46 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 46}], "cli_fix": ["interface TenGigabitEthernet1/1", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:16:24.029738Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:47:24.026702Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 40, "description": "Interface GigabitEthernet0/1 is flapping (40 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 40}], "cli_fix": ["interface GigabitEthernet0/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:18:24.031674Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:06:24.030309Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:16:24.030205Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:24:24.032103Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:11:24.025079Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 41, "description": "Interface GigabitEthernet0/0 is flapping (41 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 41}], "cli_fix": ["interface GigabitEthernet0/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:06:24.030090Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:19:24.026816Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 38, "description": "Interface TenGigabitEthernet1/1 is flapping (38 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 38}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:00:24.028760Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:43:24.029755Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:56:24.032915Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:07:24.027859Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 17, "description": "Interface GigabitEthernet1/0 is flapping (17 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 17}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:06:24.028423Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 17, "description": "Interface TenGigabitEthernet1/1 is flapping (17 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 17}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:38:24.031512Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:18:24.028014Z", "interface": "Ethernet1/1", "flap_count_10m": 48, "description": "Interface Ethernet1/1 is flapping (48 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 48}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:07:24.032413Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:07:24.029972Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:04:24.026650Z", "interface": "Ethernet1/1", "flap_count_10m": 26, "description": "Interface Ethernet1/1 is flapping (26 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1", "flap_count_10m": 26}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:34:24.031738Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:44:24.033025Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:53:24.027401Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 42, "description": "Interface GigabitEthernet0/0 is flapping (42 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 42}], "cli_fix": ["interface GigabitEthernet0/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:39:24.031180Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:09:24.031731Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:31:24.028802Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:33:24.032353Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:32:24.032228Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:06:24.028471Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 21, "description": "Interface GigabitEthernet1/0 is flapping (21 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 21}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:10:24.030589Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:12:24.029983Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:40:24.031030Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:15:24.029053Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:57:24.027165Z", "interface": "Ethernet1/1", "flap_count_10m": 46, "description": "Interface Ethernet1/1 is flapping (46 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 46}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:41:24.030667Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:43:24.031876Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:47:24.030448Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:30:24.029099Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:17:24.025468Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 19, "description": "Interface TenGigabitEthernet1/1 is flapping (19 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 19}], "cli_fix": ["interface TenGigabitEthernet1/1", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:15:24.029041Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:14:24.027252Z", "interface": "Ethernet1/1", "flap_count_10m": 44, "description": "Interface Ethernet1/1 is flapping (44 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 44}], "cli_fix": ["interface Ethernet1/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:46:24.032465Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:52:24.029441Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:13:24.025474Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 26, "description": "Interface GigabitEthernet0/1 is flapping (26 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 26}], "cli_fix": ["interface GigabitEthernet0/1", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:58:24.030437Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:58:24.030700Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:54:24.032499Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:31:24.030468Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:48:24.031259Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:16:24.027246Z", "interface": "Ethernet1/1", "flap_count_10m": 26, "description": "Interface Ethernet1/1 is flapping (26 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1", "flap_count_10m": 26}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:44:24.031939Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:03:24.031662Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:31:24.033091Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:50:24.028718Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:33:24.029546Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:41:24.025168Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 26, "description": "Interface GigabitEthernet0/1 is flapping (26 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 26}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:07:24.029093Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:27:24.028882Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:34:24.029047Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:14:24.028730Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:49:24.028826Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:08:24.026934Z", "interface": "Ethernet1/1", "flap_count_10m": 41, "description": "Interface Ethernet1/1 is flapping (41 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 41}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:05:24.032197Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:23:24.031379Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:17:24.029731Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:27:24.025309Z", "interface": "Ethernet1/1", "flap_count_10m": 30, "description": "Interface Ethernet1/1 is flapping (30 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "Ethernet1/1", "flap_count_10m": 30}], "cli_fix": ["interface Ethernet1/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:12:24.031347Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:06:24.032991Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:47:24.032844Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:05:24.032555Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:46:24.025182Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 32, "description": "Interface GigabitEthernet0/0 is flapping (32 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "flap_count_10m": 32}], "cli_fix": ["interface GigabitEthernet0/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:33:24.031279Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:05:24.025505Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 42, "description": "Interface GigabitEthernet1/0 is flapping (42 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 42}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:22:24.031605Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:26:24.029144Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:04:24.027034Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 30, "description": "Interface GigabitEthernet1/0 is flapping (30 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 30}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:12:24.032909Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:44:24.027970Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 29, "description": "Interface GigabitEthernet1/0 is flapping (29 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 29}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:05:24.029372Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:36:24.027259Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 6, "description": "Interface GigabitEthernet0/1 is flapping (6 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 6}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:28:24.026953Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 43, "description": "Interface TenGigabitEthernet1/1 is flapping (43 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 43}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:25:24.029428Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:56:24.027653Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 37, "description": "Interface TenGigabitEthernet1/1 is flapping (37 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 37}], "cli_fix": ["interface TenGigabitEthernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:52:24.025320Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 10, "description": "Interface GigabitEthernet1/0 is flapping (10 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 10}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:36:24.032741Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:29:24.027926Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 47, "description": "Interface GigabitEthernet0/0 is flapping (47 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 47}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:14:24.032034Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:32:24.033066Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:24:24.027938Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 8, "description": "Interface GigabitEthernet0/0 is flapping (8 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 8}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:23:24.032774Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:12:24.027010Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 33, "description": "Interface GigabitEthernet1/0 is flapping (33 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 33}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:25:24.031954Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:12:24.032242Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:23:24.031333Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T08:50:24.031206Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:33:24.031619Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:40:24.032543Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:49:24.032439Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:55:24.031161Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:38:24.027576Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 50, "description": "Interface GigabitEthernet0/1 is flapping (50 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 50}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:14:24.030149Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:42:24.027672Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 34, "description": "Interface GigabitEthernet1/0 is flapping (34 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 34}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:06:24.029158Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:11:24.027834Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 12, "description": "Interface GigabitEthernet1/0 is flapping (12 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 12}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:55:24.025455Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 12, "description": "Interface GigabitEthernet0/1 is flapping (12 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 12}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:32:24.031599Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:33:24.026791Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 24, "description": "Interface GigabitEthernet0/1 is flapping (24 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 24}], "cli_fix": ["interface GigabitEthernet0/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:51:24.032299Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:10:24.032730Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:29:24.032279Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:49:24.027982Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 10, "description": "Interface GigabitEthernet0/0 is flapping (10 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 10}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:03:24.029335Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:48:24.027734Z", "interface": "Ethernet1/1", "flap_count_10m": 29, "description": "Interface Ethernet1/1 is flapping (29 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 29}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:16:24.031790Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:43:24.027234Z", "interface": "Ethernet1/1", "flap_count_10m": 29, "description": "Interface Ethernet1/1 is flapping (29 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "Ethernet1/1", "flap_count_10m": 29}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T03:59:24.032316Z", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet1/0: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:59:24.028247Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 29, "description": "Interface GigabitEthernet0/1 is flapping (29 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 29}], "cli_fix": ["interface GigabitEthernet0/1", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:19:24.029190Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:13:24.027722Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 46, "description": "Interface GigabitEthernet0/1 is flapping (46 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 46}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:45:24.025154Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 14, "description": "Interface GigabitEthernet1/0 is flapping (14 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 14}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:42:24.026810Z", "interface": "Ethernet1/1", "flap_count_10m": 49, "description": "Interface Ethernet1/1 is flapping (49 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "Ethernet1/1", "flap_count_10m": 49}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:26:24.031590Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:10:24.031224Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:47:24.027290Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 28, "description": "Interface GigabitEthernet1/0 is flapping (28 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 28}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:03:24.027963Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 35, "description": "Interface GigabitEthernet1/0 is flapping (35 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 35}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:55:24.029529Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:07:24.031353Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:13:24.025441Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 31, "description": "Interface GigabitEthernet0/0 is flapping (31 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 31}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:50:24.028291Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 47, "description": "Interface GigabitEthernet0/1 is flapping (47 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 47}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:55:24.031310Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:36:24.027582Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 18, "description": "Interface GigabitEthernet0/0 is flapping (18 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "flap_count_10m": 18}], "cli_fix": ["interface GigabitEthernet0/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:28:24.027426Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 44, "description": "Interface GigabitEthernet1/0 is flapping (44 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 44}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:40:24.028008Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 14, "description": "Interface GigabitEthernet0/1 is flapping (14 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 14}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:39:24.032310Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:44:24.031492Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:39:24.027816Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 12, "description": "Interface GigabitEthernet0/1 is flapping (12 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 12}], "cli_fix": ["interface GigabitEthernet0/1", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:09:24.027853Z", "interface": "Ethernet1/1", "flap_count_10m": 9, "description": "Interface Ethernet1/1 is flapping (9 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "flap_count_10m": 9}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:04:24.029234Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:39:24.028814Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:18:24.030655Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:00:24.026915Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 22, "description": "Interface TenGigabitEthernet1/1 is flapping (22 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 22}], "cli_fix": ["interface TenGigabitEthernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:05:24.028888Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:50:24.031292Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:53:24.027060Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 31, "description": "Interface GigabitEthernet1/0 is flapping (31 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 31}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:21:24.030539Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:40:24.028680Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:58:24.031439Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:55:24.031325Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:55:24.030595Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:51:24.029462Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:26:24.025432Z", "interface": "Ethernet1/1", "flap_count_10m": 49, "description": "Interface Ethernet1/1 is flapping (49 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 49}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:35:24.026985Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 41, "description": "Interface GigabitEthernet0/1 is flapping (41 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "flap_count_10m": 41}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:25:24.029105Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:26:24.032405Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:41:24.030232Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:17:24.029116Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:41:24.030211Z", "interface": "GigabitEthernet0/0", "description": "Duplex mismatch detected on interface GigabitEthernet0/0."}, "devices": [{"name": "CORE-R2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0"}], "cli_fix": ["interface GigabitEthernet0/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:05:24.032419Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:36:24.030808Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:21:24.032203Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:45:24.029330Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:10:24.026921Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 38, "description": "Interface GigabitEthernet0/0 is flapping (38 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 38}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:24:24.028665Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:37:24.027691Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 46, "description": "Interface TenGigabitEthernet1/1 is flapping (46 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 46}], "cli_fix": ["interface TenGigabitEthernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:29:24.030798Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:26:24.030081Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:30:24.032384Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:59:24.027765Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 48, "description": "Interface GigabitEthernet0/0 is flapping (48 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "flap_count_10m": 48}], "cli_fix": ["interface GigabitEthernet0/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:47:24.030193Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:07:24.028947Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T10:38:24.031837Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:49:24.032359Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:40:24.029977Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T12:02:24.028397Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 7, "description": "Interface GigabitEthernet0/1 is flapping (7 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 7}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:07:24.030050Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:05:24.027208Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 44, "description": "Interface GigabitEthernet0/1 is flapping (44 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 44}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:24:24.031703Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:57:24.030127Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:26:24.030550Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:38:24.031154Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:29:24.031969Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:59:24.026804Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 40, "description": "Interface GigabitEthernet1/0 is flapping (40 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 40}], "cli_fix": ["interface GigabitEthernet1/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:01:24.028626Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:17:24.031982Z", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/0: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:11:24.033053Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_nxos", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:01:24.029669Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_nxos", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:47:24.028334Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 35, "description": "Interface GigabitEthernet0/0 is flapping (35 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 35}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T11:07:24.027803Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 38, "description": "Interface GigabitEthernet0/1 is flapping (38 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "flap_count_10m": 38}], "cli_fix": ["interface GigabitEthernet0/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:07:24.031147Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:50:24.028777Z", "interface": "TenGigabitEthernet1/1", "description": "Duplex mismatch detected on interface TenGigabitEthernet1/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1"}], "cli_fix": ["interface TenGigabitEthernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:49:24.032788Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:58:24.029226Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:18:24.031892Z", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on Ethernet1/1: local 9000, peer 1500."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:52:24.031581Z", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/1: local 9000, peer 1500."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:25:24.031829Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:47:24.025520Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 38, "description": "Interface GigabitEthernet0/0 is flapping (38 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "flap_count_10m": 38}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T05:15:24.027308Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 9, "description": "Interface GigabitEthernet0/1 is flapping (9 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 9}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:38:24.025461Z", "interface": "Ethernet1/1", "flap_count_10m": 30, "description": "Interface Ethernet1/1 is flapping (30 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "Ethernet1/1", "flap_count_10m": 30}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T02:12:24.026569Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 46, "description": "Interface GigabitEthernet0/0 is flapping (46 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "flap_count_10m": 46}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:55:24.027474Z", "interface": "Ethernet1/1", "flap_count_10m": 20, "description": "Interface Ethernet1/1 is flapping (20 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 20}], "cli_fix": ["interface Ethernet1/1", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:35:24.030975Z", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet1/0: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet1/0", " mtu 1500", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:42:24.030367Z", "interface": "GigabitEthernet0/1", "description": "Duplex mismatch detected on interface GigabitEthernet0/1."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1"}], "cli_fix": ["interface GigabitEthernet0/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:35:24.030649Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T08:10:24.027557Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 6, "description": "Interface GigabitEthernet1/0 is flapping (6 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 6}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:40:24.027016Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 15, "description": "Interface TenGigabitEthernet1/1 is flapping (15 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 15}], "cli_fix": ["interface TenGigabitEthernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T07:47:24.032471Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:52:24.027567Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 28, "description": "Interface GigabitEthernet0/0 is flapping (28 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 28}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:08:24.025532Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 24, "description": "Interface GigabitEthernet0/0 is flapping (24 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 24}], "cli_fix": ["interface GigabitEthernet0/0", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:33:24.028672Z", "interface": "Ethernet1/1", "description": "Duplex mismatch detected on interface Ethernet1/1."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "Ethernet1/1"}], "cli_fix": ["interface Ethernet1/1", " speed 1000", " duplex full", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T02:52:24.032549Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 1500", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T11:02:24.032171Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T09:16:24.025492Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 18, "description": "Interface TenGigabitEthernet1/1 is flapping (18 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 18}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:28:24.031780Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:10:24.025480Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 36, "description": "Interface GigabitEthernet1/0 is flapping (36 transitions in 10 minutes)."}, "devices": [{"name": "DC-SW2", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0", "flap_count_10m": 36}], "cli_fix": ["interface GigabitEthernet1/0", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:24:24.025161Z", "interface": "GigabitEthernet0/0", "flap_count_10m": 17, "description": "Interface GigabitEthernet0/0 is flapping (17 transitions in 10 minutes)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "flap_count_10m": 17}], "cli_fix": ["interface GigabitEthernet0/0", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:21:24.027054Z", "interface": "Ethernet1/1", "flap_count_10m": 44, "description": "Interface Ethernet1/1 is flapping (44 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 44}], "cli_fix": ["interface Ethernet1/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:57:24.028307Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 6, "description": "Interface GigabitEthernet1/0 is flapping (6 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "flap_count_10m": 6}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:35:24.027647Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 29, "description": "Interface GigabitEthernet0/1 is flapping (29 transitions in 10 minutes)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 29}], "cli_fix": ["interface GigabitEthernet0/1", " carrier-delay msec 200", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:54:24.025227Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 28, "description": "Interface GigabitEthernet0/1 is flapping (28 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "flap_count_10m": 28}], "cli_fix": ["interface GigabitEthernet0/1", " logging event link-status", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T07:38:24.028509Z", "interface": "GigabitEthernet0/1", "flap_count_10m": 26, "description": "Interface GigabitEthernet0/1 is flapping (26 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "flap_count_10m": 26}], "cli_fix": ["interface GigabitEthernet0/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:10:24.030606Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T04:24:24.032053Z", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on TenGigabitEthernet1/1: local 1500, peer 9000."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface TenGigabitEthernet1/1", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:00:24.032888Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:23:24.031480Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T03:55:24.027357Z", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 14, "description": "Interface TenGigabitEthernet1/1 is flapping (14 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "flap_count_10m": 14}], "cli_fix": ["interface TenGigabitEthernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T06:28:24.025289Z", "interface": "Ethernet1/1", "flap_count_10m": 13, "description": "Interface Ethernet1/1 is flapping (13 transitions in 10 minutes)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "Ethernet1/1", "flap_count_10m": 13}], "cli_fix": ["interface Ethernet1/1", " no shutdown", " load-interval 30", " exit"]}
{"incident_type": "link_duplex_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Link duplex mismatch detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T04:03:24.030576Z", "interface": "GigabitEthernet1/0", "description": "Duplex mismatch detected on interface GigabitEthernet1/0."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_nxos", "interface": "GigabitEthernet1/0"}], "cli_fix": ["interface GigabitEthernet1/0", " speed auto", " duplex auto", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T09:31:24.031458Z", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on GigabitEthernet0/1: local 1500, peer 9000."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface GigabitEthernet0/1", " mtu 9216", " exit"]}
{"incident_type": "interface_flapping", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Interface flapping detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-09T10:41:24.027623Z", "interface": "GigabitEthernet1/0", "flap_count_10m": 34, "description": "Interface GigabitEthernet1/0 is flapping (34 transitions in 10 minutes)."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "flap_count_10m": 34}], "cli_fix": ["interface GigabitEthernet1/0", " logging event link-status", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DC-SW2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T05:22:24.031286Z", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500, "description": "MTU mismatch on GigabitEthernet0/0: local 9000, peer 1500."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "local_mtu": 9000, "peer_mtu": 1500}], "cli_fix": ["interface GigabitEthernet0/0", " mtu 9216", " exit"]}
{"incident_type": "mtu_mismatch", "instruction": "Analyze interface-level incidents on Cisco devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "MTU mismatch detected (platform side)", "device": "DIST-SW1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-09T06:39:24.032769Z", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000, "description": "MTU mismatch on Ethernet1/1: local 1500, peer 9000."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_nxos", "interface": "Ethernet1/1", "local_mtu": 1500, "peer_mtu": 9000}], "cli_fix": ["interface Ethernet1/1", " mtu 1500", " exit"]}