running triage on wazuh events with a 3b local model. beats waiting on api quotas and keeps your data off someone else's gpu.
> The stream shows SOCops analyzing #wazuh events using AI. Since I exhausted Openrouter its using a local hosted LLM on ollama. The used model is Qwen2.5:3b
> I'm still debugging and co I the background. But it's looking very cool already.
— @CisoDiagonal
#cybersecurity #infosec #news #tooling
https://x.com/CisoDiagonal/status/2037944938873180165
DefectiveCISO
npub1c5…zhcn0
2026-03-28 18:36:38 UTC
Author Public Key
npub1c523x9jh7yl5fpk07xmq0zs09tfapqav6rpt7343j23nlruqalyqezhcn0Published at
2026-03-28 18:36:38 UTCEvent JSON
{
"id": "68a73a68e92afd37fdaeaffc19d37c2014eca248034704849143b1f7f9c05cd1",
"pubkey": "c515131657f13f4486cff1b6078a0f2ad3d083acd0c2bf46b192a33f8f80efc8",
"created_at": 1774722998,
"kind": 1,
"tags": [
[
"t",
"cybersecurity"
],
[
"t",
"infosec"
],
[
"t",
"news"
],
[
"t",
"tooling"
],
[
"r",
"https://x.com/CisoDiagonal/status/2037944938873180165"
],
[
"source",
"x.com"
]
],
"content": "running triage on wazuh events with a 3b local model. beats waiting on api quotas and keeps your data off someone else's gpu.\n\n\u003e The stream shows SOCops analyzing #wazuh events using AI. Since I exhausted Openrouter its using a local hosted LLM on ollama. The used model is Qwen2.5:3b\n\u003e I'm still debugging and co I the background. But it's looking very cool already.\n— @CisoDiagonal\n\n#cybersecurity #infosec #news #tooling\nhttps://x.com/CisoDiagonal/status/2037944938873180165",
"sig": "afd750c35a7bb62fe20e93793a580fce5d3c576252da21d76427806adeb3364b2208505d841065e9fb4b9d3729b9daa1dfe7a0a442d9c95c02e2b816284cf474"
}