Building a Local AI SOC Lab with Wazuh and Qwen: Lessons from a Real Implementation

说明与用途

使用 Wazuh 和 Qwen 的本地 SOC 实验室展示了 LLM 如何在严格的只读边界内协助分析师，但需要可靠的数据检索、状态持久化和安全过滤。

问题

Can a locally hosted AI model help a security analyst investigate Wazuh alerts without giving the AI control over the infrastructure?

结果

The lab demonstrates that a locally hosted LLM can assist analysts with structured incident reports while maintaining strict read‑only boundaries, but requires reliable data retrieval, state persistence, and safety filtering.

工作流

• Set up Ubuntu 24.04 VMs with Wazuh Agent, Manager, and OpenSearch; configure SSH port forwarding and TLS for secure access.
• Develop Python SOC Assistant to query OpenSearch using Scroll pagination and retrieve alerts.
• Store processed event IDs and incident reports in SQLite for reliable state and recovery.
• Connect LM Studio’s local API to Qwen 3.5‑4B Instruct and send selected events, requesting structured JSON output.
• Validate required fields in the model response before saving the report.
• Implement conservative recommendation filtering and regression tests to prevent unsafe actions.
• Run 31 mocked and offline Python tests via GitHub Actions to verify event identity, persistence, and read‑only boundaries.
• Manually execute the workflow and review AI-generated findings with a human analyst.
• Iterate on prompt design and safety measures based on testing results.

证据

I wanted to explore a practical question: Can a locally hosted AI model help a security analyst investigate Wazuh alerts without giving the AI control over the infrastructure?

来源

I improved the Python client using OpenSearch Scroll pagination to retrieve a bounded snapshot of matching alerts.

来源

During verification, I successfully migrated 20 existing event IDs and confirmed database integrity.

来源

The application validates required fields before saving a report.

来源

I introduced conservative recommendation filtering and regression tests to help keep responses within the lab's read-only investigation scope.

来源

The repository includes 31 mocked and offline Python tests, exercised through GitHub Actions using Python 3.10 and 3.12.

来源