Building a Local AI SOC Lab with Wazuh and Qwen: Lessons from a Real Implementation

Описание и применение

Локальная лаборатория SOC с Wazuh и Qwen демонстрирует, как LLM может поддерживать аналитиков, сохраняя строгие ограничения доступа и обеспечивая структурированные отчёты, но требует надёжного извлечения данных, сохранения состояния и фильтрации опасных рекомендаций.

Задача

Can a locally hosted AI model help a security analyst investigate Wazuh alerts without giving the AI control over the infrastructure?

Результат

The lab demonstrates that a locally hosted LLM can assist analysts with structured incident reports while maintaining strict read‑only boundaries, but requires reliable data retrieval, state persistence, and safety filtering.

Рабочий процесс

• Set up Ubuntu 24.04 VMs with Wazuh Agent, Manager, and OpenSearch; configure SSH port forwarding and TLS for secure access.
• Develop Python SOC Assistant to query OpenSearch using Scroll pagination and retrieve alerts.
• Store processed event IDs and incident reports in SQLite for reliable state and recovery.
• Connect LM Studio’s local API to Qwen 3.5‑4B Instruct and send selected events, requesting structured JSON output.
• Validate required fields in the model response before saving the report.
• Implement conservative recommendation filtering and regression tests to prevent unsafe actions.
• Run 31 mocked and offline Python tests via GitHub Actions to verify event identity, persistence, and read‑only boundaries.
• Manually execute the workflow and review AI-generated findings with a human analyst.
• Iterate on prompt design and safety measures based on testing results.

Доказательства

I wanted to explore a practical question: Can a locally hosted AI model help a security analyst investigate Wazuh alerts without giving the AI control over the infrastructure?

Источник

I improved the Python client using OpenSearch Scroll pagination to retrieve a bounded snapshot of matching alerts.

Источник

During verification, I successfully migrated 20 existing event IDs and confirmed database integrity.

Источник

The application validates required fields before saving a report.

Источник

I introduced conservative recommendation filtering and regression tests to help keep responses within the lab's read-only investigation scope.

Источник

The repository includes 31 mocked and offline Python tests, exercised through GitHub Actions using Python 3.10 and 3.12.

Источник