Two LLM Security Assistants for Wazuh and AWS Analysis

from transformers import AutoModelForCausalLM, AutoTokenizer

model = AutoModelForCausalLM.from_pretrained("pyToshka/wazuh-llama-3.1-8b-assistant")
tokenizer = AutoTokenizer.from_pretrained("pyToshka/wazuh-llama-3.1-8b-assistant")

prompt = """Analyze this Wazuh alert:

Multiple failed SSH login attempts from IP 45.142.120.10
Rule Level: 10
Event: sshd authentication failure

Provide:
1. Threat level
2. Attack type
3. Recommended actions
"""

inputs = tokenizer(prompt, return_tensors="pt")
outputs = model.generate(**inputs, max_new_tokens=512)
response = tokenizer.decode(outputs[0], skip_special_tokens=True)
print(response)

# Installation
ollama pull OpenNix/wazuh-llama-3.1-8B-v1

# Interactive mode
ollama run OpenNix/wazuh-llama-3.1-8B-v1

# Via API
curl http://localhost:11434/api/generate -d '{
  "model": "OpenNix/wazuh-llama-3.1-8B-v1",
  "prompt": "Analyze this Wazuh alert: Multiple failed SSH login attempts from IP 45.142.120.10",
  "stream": false
}'

Response:
1. Threat level: High
2. Attack type: Password attack
3. Recommended actions: "Verify user credentials and password", "Enable two-factor authentication", "Update system to latest version", "Check for security updates", etc.
4. Additional information: "IP address 45.142.120.10" is the IP address from which failed login attempts originated. "sshd authentication failure" is the rule description, indicating the attack is targeting the SSH server.

Analysis:
This alert indicates a password attack, as the rule has a threat level of 10, suggesting a high level of danger. Therefore, recommended actions include verifying user credentials and password, enabling two-factor authentication, and updating the system to the latest version. The additional information that IP address 45.142.120.10 is where the failed login attempts originated suggests the attack came from this IP address.

Reasoning Skills:
To respond to this alert, analytical and reasoning skills are required. Specifically, you need to:

* Identify the attack type and its objective.
* Assess the threat level and take appropriate protective measures.
* Verify user credentials and password.
* Enable two-factor authentication.
* Update the system to the latest version.
* Check for security updates.

Thus, this alert requires analytical and reasoning skills to identify the attack type, assess the threat level, and take protective measures. Recommended actions include verifying user credentials and password, enabling two-factor authentication...

from transformers import AutoModelForCausalLM, AutoTokenizer

model = AutoModelForCausalLM.from_pretrained("pyToshka/aws-security-analyst")
tokenizer = AutoTokenizer.from_pretrained("pyToshka/aws-security-analyst")

prompt = """Analyze this AWS security event:

Event Source: GuardDuty
Finding Type: UnauthorizedAccess:EC2/SSHBruteForce
Severity: 8.0
Resource: EC2 instance i-1234567890abcdef0
Source IP: 45.142.120.10

Provide:
1. Threat assessment
2. MITRE ATT&CK techniques
3. Compliance impact
4. Recommended actions
"""

inputs = tokenizer(prompt, return_tensors="pt")
outputs = model.generate(**inputs, max_new_tokens=512)
print(tokenizer.decode(outputs[0], skip_special_tokens=True))

# Installation
ollama pull OpenNix/aws-security-assistant

# Analyze CloudTrail event
ollama run OpenNix/aws-security-assistant \
  "Analyze: Root user attached AdministratorAccess policy at 3 AM"

# Via API
curl http://localhost:11434/api/generate -d '{
  "model": "OpenNix/aws-security-assistant",
  "prompt": "Analyze GuardDuty finding: Cryptocurrency mining detected on EC2",
  "stream": false
}'

# For Wazuh
from transformers import AutoModelForCausalLM, AutoTokenizer

wazuh_model = AutoModelForCausalLM.from_pretrained("pyToshka/wazuh-llama-3.1-8b-assistant")
wazuh_tokenizer = AutoTokenizer.from_pretrained("pyToshka/wazuh-llama-3.1-8b-assistant")

# For AWS
aws_model = AutoModelForCausalLM.from_pretrained("pyToshka/aws-security-analyst")
aws_tokenizer = AutoTokenizer.from_pretrained("pyToshka/aws-security-analyst")

# Install Ollama
curl -fsSL https://ollama.com/install.sh | sh

# Wazuh Assistant
ollama pull OpenNix/wazuh-llama-3.1-8B-v1
ollama run OpenNix/wazuh-llama-3.1-8B-v1

# AWS Security Analyst
ollama pull OpenNix/aws-security-assistant
ollama run OpenNix/aws-security-assistant

# docker-compose.yml
services:
  ollama:
    image: ollama/ollama:latest
    ports:
      - "11434:11434"
    volumes:
      - ./ollama:/root/.ollama
    restart: always
    environment:
      - OLLAMA_KEEP_ALIVE=24h
      - OLLAMA_HOST=0.0.0.0

docker-compose up -d

# Pull models
docker exec -it ollama bash
ollama pull OpenNix/wazuh-llama-3.1-8B-v1
ollama pull OpenNix/aws-security-assistant

#!/var/ossec/framework/python/bin/python3
from ollama import Client

def analyze_wazuh_alert(alert):
    client = Client(host='http://localhost:11434')
    
    response = client.chat(
        model='OpenNix/wazuh-llama-3.1-8B-v1',
        messages=[{
            'role': 'user',
            'content': f'Analyze this Wazuh alert: {alert}'
        }]
    )
    
    return response['message']['content']

if __name__ == "__main__":
    alert = sys.argv[1]
    analysis = analyze_wazuh_alert(alert)
    send_to_wazuh(analysis) 

Multiple failed SSH login attempts from 103.85.24.45
Rule: 5710 | Level: 10 | sshd: authentication failure

Threat Level: 12/15 - High Severity
Attack Type: SSH Brute-force (MITRE T1110.001)
Risk: Active credential compromise attempt
Actions:
1. Block IP immediately via firewall/fail2ban
2. Check for successful logins from same /24 subnet
3. Enable 2FA if not configured
4. Review SSH key-based auth configuration

CloudTrail Event: AttachUserPolicy
User: dev-user
Policy: AdministratorAccess
Time: 02:47 AM UTC
Source IP: 185.220.101.45 (Tor exit node)

Threat Assessment: CRITICAL
MITRE ATT&CK: T1098.001 - Account Manipulation: Additional Cloud Credentials
Compliance Impact:
- CIS AWS Foundations: 1.16 (IAM policies)
- PCI-DSS: 7.1, 7.2 (Access control)

Attack Scenario: Privilege Escalation via Policy Attachment
1. Compromised dev-user account (low privileges)
2. Attached AdministratorAccess (privilege escalation)
3. Source IP is Tor node (attacker hiding identity)

Immediate Actions:
1. REVOKE AdministratorAccess from dev-user NOW
2. Rotate dev-user credentials immediately
3. Review CloudTrail for other actions from this IP
4. Check for data exfiltration (S3 GetObject, etc.)
5. Enable MFA delete on critical S3 buckets
6. Implement SCPs to prevent policy attachment by non-admin users