CyberSOC AI — Gemma 4 SOC Assistant

A LoRA fine-tuned adapter on Gemma 4 E4B for Security Operations Center (SOC) analysis. It explains security detection rules, interprets logs, and maps activity to MITRE ATT&CK techniques.

What it does

• Explains Sigma detection rules
• Interprets Windows Event Logs (EVTX) and Linux auditd events
• Understands Wazuh alerts
• Maps events to MITRE ATT&CK techniques
• Produces structured SOC analyst assessments (Description, Severity, Log Source, MITRE tags)

Base Model

• Base: google/gemma-4-E4B-it (~8B params)
• Method: QLoRA (4-bit) fine-tuning
• Trainable params: ~36.7M (0.46% of total)
• LoRA rank: 16

Training Data

Fine-tuned on a combined cybersecurity dataset (~52,600 examples) covering Windows and Linux:

Total: ~52,609 training examples (the Linux portion was refined from a raw corpus of over 2 million log entries down to high-signal auditd events).

Training Setup

• Hardware: Kaggle Tesla T4 x2
• Framework: Unsloth + TRL (SFTTrainer)
• Steps: 400 (max_steps)
• Batch: 2 x grad_accum 4
• Learning rate: 2e-4, linear scheduler
• Optimizer: adamw_8bit
• Final training loss: ~0.13

How to Use

from unsloth import FastModel

model, tokenizer = FastModel.from_pretrained(
    model_name = "tareq052/cybersoc-gemma4-adapter",
    max_seq_length = 1024,
    load_in_4bit = True,
)
FastModel.for_inference(model)

Limitations

• The Linux auditd training data was template-generated and shallow, so the model is strong at formatting and parsing but may under-assess threat severity on Linux events. Windows detection performance is stronger due to more varied source data.
• This is a research/learning project, not a production security tool. Always verify outputs with a human analyst.

License

Apache 2.0 (inherited from Gemma 4).