SOC Operations

The security stack raises the alerts. This is what reads them - a local analyst that works the nightly report end to end and hands a human a short list. It runs on the box, and there is no cloud model in the loop.

The one rule everything else follows from: the model never adjudicates. A deterministic guardrail makes every authorization call; the local LLM does volume triage and investigation; a human keeps every verdict. The interesting engineering was never the model - it was the deterministic shell around it, and treating the model's own input as hostile.

What it does

Every night at 04:00 the pipeline pulls 24h of Wazuh / Suricata / VPN / CVE telemetry, has a local model (Ornith, a 9B) triage and investigate it, writes the report's Executive Summary itself, and pushes a morning digest to Telegram. It is fully local - the only thing that ever leaves the box is an explicit threat-intel lookup (a hash or IP the analyst chooses to check).

The pipeline at a glance

nightly SOC pass · deterministic floor wraps the model

04:00 fetch 24h Wazuh/Suricata/VPN/CVE -> build the report | v [ deterministic floor ] guardrail decides every authorization (sec-note + known-noise) | -> KNOWN / FLAG, WITHOUT the model | +--> L1 (Ornith, no-think) classifies only what the floor DEFERRED | temp 0, output GRAMMAR-CONSTRAINED to a verdict | +--> L2 (Ornith, thinking) investigates the WHOLE report, per item, read-only tools: | reads the raw event, looks it up, says what it IS, | confirm-benign-and-downgrade OR escalate with a next step v exec summary (local) posture + verdicts + action items COMPUTED; the model writes only prose | v 09:00 Telegram digest posture + open items -> a bot whose token never leaves the Wazuh VM

# Claude built and maintains the scripts. Claude is NOT in the nightly loop - the whole pass is local.

The tiers

Deterministic floor - authorization is code, not opinion. A "sensitive action" (new admin account, a cleared log, a promiscuous NIC) is only KNOWN if a matching operator note authorized it in the window; no note, it flags - regardless of what the model thinks, because the model is never asked.
L1 - a fast per-alert classifier. Runs at temperature 0 with its output constrained by a grammar, so the decoder is physically incapable of emitting anything but a verdict. It closes the obvious.
L2 - the investigator. Gets a fixed set of read-only tools, reviews the whole report item by item, and has to say what each thing actually is - never "requires human review to determine scope."
Human - keeps the final verdict, always.

It reads the actual event

The difference a real investigation makes, on one finding that used to page every night:

L2 investigation · a level-12 "critical error" that was a clock

wazuh_query --rule 100160 --agent wazuh-server

log=system,critical,info cloud change time Jul/09/2026 22:11:03 => 22:11:08

DECISION

CONFIRM-BENIGN - RouterOS logs its cloud NTP time adjustment under the "critical" topic, so Wazuh flags it level 12. This is the router nudging its own clock five seconds.

# the old pipeline escalated this nightly; this one pulls the router's own log line, recognises it, and lowers the severity

The honest bits

It runs on CPU. Ornith is a hybrid (Gated-DeltaNet + attention) architecture whose recurrence is CPU-bound and does not offload usefully to this box's 4 GB GPU - I measured it, and matching threads to physical cores won by more than any partial offload (the hardware notes and the inference-tuning write-up). At 04:00 the wall-clock does not matter.
It is a 9B. Small models compress and occasionally mis-format; the whole design leans on the deterministic floor and the tools so the model is never trusted with a load-bearing call - it gathers and phrases, it does not decide authorization.

Full mechanics - the six read-only tools, the whole-report per-item review, the Claude-free Executive Summary, the threat-intel tie-in, and the security engineering that lets a model read attacker-controlled logs without being steered by them →