Introducing Wazuh LLM: Fine-Tuned Llama 3.1 for Security Event Analysis#

Deep Wazuh Understanding#

The model must know the event structure, rules, severity levels, and the context of Wazuh as a SIEM system.

MITRE ATT&CK Knowledge#

The ability to map events to tactics and techniques from the MITRE ATT&CK framework is critical for understanding attack chains.

Practical Recommendations#

It’s not enough to just describe the problem — the model must suggest concrete actions for incident response.

Risk Assessment#

The model should evaluate threat severity and prioritize response efforts.

These requirements formed the foundation for fine-tuning Llama 3.1 8B to create Wazuh LLM.

🎯 Rule Level Determination#

Automatic classification of event severity from low to critical level.

🔍 Event Type Identification#

Determining the incident category — from brute force attempts to rootkit detection.

📝 Detailed Reasoning#

Comprehensive explanation of why this event represents a threat and what attack mechanism might be employed.

⚠️ Risk Assessment#

Analysis of potential system impact considering context and possible consequences.

🛡️ Action Recommendations#

Specific steps for incident response, including technical measures and investigation procedures.

🔬 Investigation Guidance#

Advice for further incident analysis and searching for indicators of compromise.

🗺️ MITRE ATT&CK Mapping#

Automatic correlation of events to tactics and techniques from the MITRE ATT&CK framework.

🌍 Multilingual Support#

Analysis support in English, Russian, and other languages, making the model useful for international security teams.

Example 1: SSH Connection Attempt Analysis#

Query to the model in English:

1
ollama run mranv/siem-llama-3.1:v1 "Analyze this Wazuh alert: SSH login from 192.168.1.100 to root account"

Model Response:

1
Rule Level: 12 - High importance event
2

3
Event Type: Unauthorized SSH Login
4

5
Detailed Reasoning: There has been an unauthorized SSH login attempt from
6
the IP address 192.168.1.100 to the system's root account. This is a high
7
priority event as it indicates potential compromise of the system.
8

9
Risk Assessment: Medium to High Risk - An unauthorized SSH login attempt to
10
the root account may indicate successful exploitation of a vulnerability,
11
brute force attack, or other malicious activity. If left unchecked, this
12
could lead to data breaches, system compromise, service disruption, and
13
other security incidents.
14

15
Recommended Actions: Block the source IP 192.168.1.100 at the firewall level,
16
change the root password, review system logs for further indicators of
17
compromise, and run a full system scan with an antivirus program.
18

19
Investigation Guidance: Review SSH login history for suspicious activity,
20
check for any successful logins from the same source IP, review system
21
configuration for security vulnerabilities, and monitor system performance
22
for signs of compromise.
23

24
MITRE ATT&CK: T1078 - Valid Accounts (possible)

Example 2: Malware Detection Analysis#

Query with JSON event structure:

1
ollama run mranv/siem-llama-3.1:v1 '{
2
  "timestamp": "2025-01-15T14:00:00Z",
3
  "agent": {"id": "000", "name": "malware_detection-00", "ip": "10.0.0.100"},
4
  "rule": {
5
    "id": "600",
6
    "level": 13,
7
    "description": "Rootkit detected in system",
8
    "groups": ["rootkit", "malware", "attack"],
9
    "category": "malware_detection",
10
    "mitre": {"id": ["T1014"], "tactic": ["Defense Evasion"]}
11
  },
12
  "data": {
13
    "severity": "high",
14
    "file": "/tmp/malware_0.exe",
15
    "malware_name": "Trojan.Generic",
16
    "action": "quarantined",
17
    "scanner": "ClamAV"
18
  },
19
  "location": "/var/log/malware_detection/security.log"
20
}'

Model Response:

1
Rule Level: 13 - Unusual error
2

3
Event Type: Rootkit Detection
4

5
Detailed Reasoning: Rule 600 triggered due to detection of rootkit in system.
6
This indicates potential for malicious activity and requires investigation.
7

8
Risk Assessment: Medium risk - Rootkits can indicate presence of other malware,
9
compromise system integrity, and provide backdoor access for attackers.
10

11
Recommended Actions: Quarantine the detected file (/tmp/malware_0.exe) and
12
notify incident response team. Review system logs for any suspicious activity.
13
Run full system scan with anti-malware software to ensure thorough cleaning.
14

15
Investigation Guidance: Document event details, review system configuration
16
for vulnerabilities, check for signs of lateral movement, and report findings
17
to incident response team.
18

19
MITRE ATT&CK: T1014 (Rootkit)

Example 3: Brute Force Attack (Multilingual)#

1
ollama run mranv/siem-llama-3.1:v1 "Analyze: 100+ SSH connection attempts detected in 5 minutes"

Model Response:

1
Rule Level: 12 - High importance event
2

3
Event Type: Brute Force Attack
4

5
Detailed Reasoning: Too many SSH connection attempts may indicate a brute
6
force attack on the system. This is when an attacker tries to guess a user's
7
password using various character combinations.
8

9
Risk Assessment: High risk, because if the attacker successfully guesses the
10
password, they will be able to gain access to the system and cause harm.
11

12
Recommended Actions: Increase password complexity requirements, enable
13
two-factor authentication (2FA) for additional protection. System administrator
14
should also consider blocking IP addresses from which attacking requests are
15
coming.
16

17
Investigation Guidance: Check system logs for other attacks and verify user
18
passwords for security. The source of the attack should also be identified
19
and reported to appropriate authorities.
20

21
MITRE ATT&CK: T1110 - Brute Force

Installing Ollama#

If you don’t have Ollama installed yet, follow these steps:

Linux and macOS:

1
curl -fsSL https://ollama.com/install.sh | sh

Windows: Download the installer from the official Ollama website.

Docker:

1
docker run -d -v ollama:/root/.ollama -p 11434:11434 --name ollama ollama/ollama

Downloading Wazuh LLM#

After installing Ollama, download the model:

Base Model:

1
ollama pull mranv/siem-llama-3.1:base

V1 Model (Recommended):

1
ollama pull mranv/siem-llama-3.1:v1

Running the Model#

Interactive Mode:

1
ollama run mranv/siem-llama-3.1:v1

Analyze Specific Alert:

1
ollama run mranv/siem-llama-3.1:v1 "Your query or Wazuh event JSON"

Using via API#

The model is also available through the Ollama REST API:

1
curl http://localhost:11434/api/generate -d '{
2
  "model": "mranv/siem-llama-3.1:v1",
3
  "prompt": "Analyze this Wazuh alert: Multiple failed login attempts from 10.0.0.50",
4
  "stream": false
5
}'

Python Integration#

1
import requests
2
import json
3

4
def analyze_security_log(log_data):
5
    response = requests.post(
6
        'http://localhost:11434/api/generate',
7
        json={
8
            'model': 'mranv/siem-llama-3.1:v1',
9
            'prompt': f"Analyze this Wazuh log: {log_data}",
10
            'stream': False
11
        }
12
    )
13
    return response.json()
14

15
# Example usage
16
log = {
17
    "timestamp": "2025-01-15T14:00:00Z",
18
    "rule": {
19
        "id": "5710",
20
        "level": 5,
21
        "description": "sshd: Attempt to login using a non-existent user"
22
    },
23
    "data": {
24
        "srcip": "192.168.1.100",
25
        "dstuser": "admin"
26
    }
27
}
28

29
result = analyze_security_log(json.dumps(log))
30
print(result['response'])

Technical Specifications#

Integration Workflows#

Wazuh LLM can be integrated into various security workflows:

Scenario 1: Initial Alert Analysis#

A SOC analyst receives an alert about suspicious activity. Instead of spending time on manual analysis, they can send the event to Wazuh LLM and receive structured analysis with recommendations in seconds.

Scenario 2: Training Junior Analysts#

New employees can use the model as an interactive learning tool, asking questions about different attack types and receiving detailed explanations with examples.

Scenario 3: Incident Prioritization#

With a large number of alerts, the model helps quickly assess the risk of each event and properly prioritize response efforts.

Scenario 4: Incident Documentation#

The model can assist in creating structured incident reports, including event description, impact assessment, and remediation recommendations.

Specialization vs. Universality#

General models like GPT-4 have broad knowledge but don’t specialize in specific domains. Wazuh LLM is trained specifically on the context of Wazuh security events, making its responses more accurate and relevant for SOC analysts.

Local Deployment#

Unlike cloud solutions, Wazuh LLM can run locally, which is critical for organizations with data confidentiality requirements. You have complete control over where your security data is processed.

Cost Efficiency#

Using Wazuh LLM through Ollama is free, while commercial model APIs can be expensive with large analysis volumes.

Customization for Your Needs#

Since the model is available locally, you can fine-tune it on your specific data and Wazuh rules, which is impossible with commercial cloud solutions.

1. Provide Context#

When formulating queries, try to be specific and include as much context as possible. Instead of general descriptions, provide the complete JSON structure of the Wazuh event for the most accurate analysis.

2. Use as Starting Point#

Use the model’s analysis results as a starting point for your own investigation, not as a final conclusion. The model provides expert recommendations, but the final decision should always be made by a human considering the full context of your infrastructure.

3. Keep Updated#

Regularly update the model to the latest version to get improved analysis algorithms and support for new attack types.

4. Combine with Other Tools#

Combine the model with other security tools to get the most complete picture of an incident.

Method 1: Interactive Session#

1
# Start interactive session
2
ollama run mranv/siem-llama-3.1:v1
3

4
# Type your queries directly
5
>>> Analyze: Failed SSH login from 203.0.113.5

Method 2: Single Command#

1
ollama run mranv/siem-llama-3.1:v1 "Analyze this alert: Rootkit detected at /tmp/suspicious.exe"

Method 3: JSON Log Analysis#

1
ollama run mranv/siem-llama-3.1:v1 '{
2
  "rule": {"level": 10, "description": "Brute force attack"},
3
  "data": {"srcip": "10.0.0.1", "attempts": 150}
4
}'

GPU Acceleration#

1
# Use GPU for faster inference
2
OLLAMA_GPU=1 ollama run mranv/siem-llama-3.1:v1

Memory Management#

1
# Adjust context size for memory constraints
2
ollama run mranv/siem-llama-3.1:v1 --num-ctx 4096 "Analyze..."

Batch Processing#

1
# Process multiple logs
2
cat security_logs.json | while read log; do
3
  ollama run mranv/siem-llama-3.1:v1 "$log"
4
done

Current Capabilities#

• ✅ Analysis of Wazuh security events with JSON structure
• ✅ Risk assessment and response recommendations
• ✅ MITRE ATT&CK framework mapping
• ✅ Multilingual support (English, Russian, Finnish)
• ✅ Local deployment for data privacy
• ✅ API integration capabilities

Planned Improvements#

• 🔄 Expanded support for all Wazuh rule types
• 🔄 Deeper MITRE ATT&CK integration
• 🔄 Improved event correlation for attack chain identification
• 🔄 Large-scale log analysis support
• 🔄 Automatic incident report generation
• 🔄 Enhanced multilingual capabilities

Key Takeaways#

• 🎯 Specialized for Security: Fine-tuned specifically for Wazuh event analysis
• 🔒 Privacy-Focused: Run locally without sending data to cloud services
• 💰 Cost-Effective: Free alternative to commercial AI solutions
• 🌍 Multilingual: Support for multiple languages
• 🔗 Integration-Ready: Easy API access for automation
• 📊 Comprehensive: MITRE ATT&CK mapping and detailed recommendations