kezekshi-l1

At a glance

kezekshi-l1 is a local first-line triage loop for Wazuh security alerts. Deterministic allowlist rules close known operational noise without a model; the ambiguous remainder goes to a fine-tuned Gemma 4 E2B running in Ollama, which writes a card for the second line: verdict, claims tied to numbered evidence, MITRE ATT&CK techniques, gaps and next checks. In the default assist mode the model closes nothing. Worth a look for a Wazuh team drowning in noise; treat it as a draft-writer, not a decider.

Good fit

A small SOC or lab already running Wazuh that wants routine noise cleared and L2 tickets pre-drafted without sending alert data to a cloud service. On the author's lab stream (3,000 alerts) 98.1% of alerts were resolved before any model call, and the model answered in 2 to 5 seconds per alert on a laptop with 8 GB of video memory.

Consider something else when

Skip it if you do not run Wazuh, need a decider you can trust to close escalations, or cannot read Russian: the README, operator guide and console output are in Russian. The author states the model is not validated as an autonomous escalation decider and that recall on real attacks has not been measured. Also skip if you cannot keep Ollama off untrusted networks, since Ollama runs without authentication.

Start here

Install Python 3 and Ollama, then fetch the weights with hf download oleg-vdv/kezekshi-l1 --local-dir kezekshi-l1-v6 and run ollama create kezekshi-l1-v6 -f Modelfile inside that folder. Run python eval/test_schema.py for offline checks, then from pipeline/ run MODEL=kezekshi-l1-v6 OLLAMA=http://localhost:11434/api/chat python run.py --dry-run samples/wazuh_alerts.sample.jsonl to see cards on the bundled sample alerts before connecting a read-only Wazuh account.

Cost and requirements

Code and weights are Apache 2.0, and the base Gemma 4 model is Apache 2.0; no paid service is involved. You supply the hardware: the Q8_0 weights are 4.9 GB, and the author's timings came from an 8 GB GPU laptop. The pipeline service uses only the Python standard library. Retraining needs torch, transformers, peft and accelerate plus llama.cpp for GGUF conversion. Wazuh access is a read-only indexer account on wazuh-alerts-*.

Limits to know

The published numbers come from a private test set dated 06.11.2026 and cannot be reproduced, because the training data (course material and a closed lab's alerts) is unpublished. The author notes 30 of 76 familiar and 63 of 100 real cases nearly match training data, the real-noise set has no attacks, and its labels reflect one analyst. Training inputs contained the author's lab host names and internal addresses; a 306-attempt extraction check found none, but the author does not rule out memorization. The service setup documents Windows Task Scheduler and is a single-instance daemon. The repository was created on 06.11.2026.

Related work

• Ollama, the local runtime that serves the fine-tuned triage model (complement)

Still unclear

• How many real attacks the triage loop would escalate on your own alert stream; the author has not measured recall on real attacks.
• Whether the daemon runs as a service on Linux; the operator guide documents only a Windows Task Scheduler setup.