Teaching my SIEM to triage itself: AI-assisted alert handling with a council of models
How I am building an alert-handling layer on top of Wazuh: a local LLM writes first-pass summaries, I triage with a written playbook, and a council of models gates any automated patching, failing safe to high risk.
Read Private repository