selected projects

A five-stage pipeline pulls and normalizes alerts, runs each through an LLM triage step (verdict, confidence, rationale, MITRE technique guess), correlates alerts sharing a host, user, or source IP into incidents, orders them into an attack chain by MITRE tactic sequence, and proposes containment tasks. The response layer is deliberately conservative: a person approves every action, zuumb can only dispatch a fixed allowlist of tasks through Wazuh's own Active Response module via a separate least-privilege API user, and it ships in dry-run with every approval written to an audit log. Analyst overrides feed back into the next triage prompt as worked examples; on a 34-alert labeled evaluation set this moved triage accuracy from 82% to 94%, with malicious-verdict precision of 1.00 and no malicious alert ever scored benign (a small, self-labeled set, so treat it as directional rather than a benchmark).