Alerts don't wait for morning.
A level-12 Wazuh alert at 2 a.m. needs the same six things every time: look up the IP, SSH in, tail the logs, decide if it's real, write it up, tell someone. That loop is the whole job of this system.
Nine stages. The failures are recorded too.
One alert, webhook to verdict.
Twenty-five seconds. A real execution, the report it produced, and the numbers it recorded — nothing reconstructed.
Five bugs were invisible until I ran it.
Every one failed silently — wrong numbers, a missing report, or a report about nothing. Never a crash. The pipeline reported success throughout.
The AI writes the report. It does not decide what happens.
Blocking is deterministic and gated four ways. All four must agree before a single firewall rule is written.
A row highlights on arrival, then stops. It is not animated through the pipeline — by the time the row exists the workflow finished about two minutes ago, and pretending otherwise would be theatre.
Nothing leaves your network.
Inference runs on a local Ollama model. Alert contents, log excerpts and hostnames never reach a cloud provider. The only outbound calls are the two threat-intel lookups you explicitly enable — and when either is unavailable the record reads unknown, never clean.
90 nodes · llama3.1:8b · local inference · 16 fixes documented · built by Zaid