LOCAL AI SECURITY AUTOMATION TELEMETRY ANALYSIS

ACTIVE DEV // IN PROGRESS

CyberAI

Local AI Cybersecurity Agent Platform & Telemetry Analysis Assistant

An ongoing local-inference cybersecurity environment focused on private, on-device intelligence. Integrates Ollama, Qwen3-Coder 30B, and OpenCode with Kali Linux security tooling to orchestrate multi-agent development workflows, automated vulnerability analysis tasks, and reproducible security experimentation.

PROJECT STATUS

Active Dev // In Progress

CORE FOCUS

Telemetry & Incident Triage

NEURAL MODEL

Qwen3-Coder 30B (Local)

AGENT INTEGRATION

OpenCode & Ollama

Python Ollama Qwen3-Coder 30B OpenCode Kali Linux Log Parsing Incident Timelines Syslog / Auth Logs Threat Correlation

arrow_back Back to Projects code View Source Repository open_in_new

info Implementation details documented at project repository

verified

Information Source & Classification: Based on the documented architecture and system descriptions in the portfolio and resume. Implementation source code is hosted in the developer's external repository.

fact_check

Standardized Case Study Specification (13 Parameters)

CLASSIFICATION: Personal Project · AI Security Research

target 1. Objective

Develop a domain-specialized cybersecurity AI assistant trained on offensive & defensive tactics, MITRE ATT&CK, and secure code review.

computer 2. Environment

Local Linux workstation, PyTorch, Hugging Face Transformers, Ollama, QLoRA quantization runtime.

schema 3. Architecture

Local fine-tuning and retrieval-augmented generation (RAG) pipeline ingesting security writeups, RFCs, and exploit mitigation guides.

build 4. Tools & Stack

Python, PyTorch, Hugging Face, Ollama, ChromaDB, Sentence-Transformers.

code 5. Implementation

Curated dataset of authorized security challenges, CVE documentation, and defensive remediation patterns.

flaky 6. Testing & Verification

Evaluated against standard cybersecurity QA benchmarks and adversarial prompt injection datasets.

inventory_2 7. Evidence & Artifacts

Model evaluation metrics, context retrieval relevance scores, response latency telemetry.

visibility 8. Security Findings

Domain-adapted embeddings significantly outperform generic embeddings for security terminology and syntax matching.

speed 9. Operational Impact

Provides offline security engineering and code audit advice with complete data residency.

shield 10. Defensive Remediation

Context filtering to prevent outputting functional exploits for unpatched zero-days or out-of-scope third-party targets.

psychology 11. Lessons Learned

Retrieval precision is vastly more critical than model parameter count for cybersecurity code analysis.

update 12. Future Roadmap

Integration with IDE extensions and real-time static application security testing (SAST) feedback loops.

info OVERVIEW & MISSION // 01

What is CyberAI?

psychology Purpose & Problem Solved

Security operations generate vast quantities of operational telemetry: system authentication attempts (`auth.log`), kernel messages, firewall connection drops, and security utility outputs. Analyzing these raw, unstructured logs manually during incident investigations or lab exercises is time-consuming and error-prone.

The portfolio project documentation describes CyberAI as a private, on-device telemetry ingestion and triage platform. It ingests raw logs, normalizes them into structured incident timelines, and applies contextual anomaly detection heuristics combined with local neural reasoning to identify correlated attack patterns.

shield Privacy & Air-Gapped Philosophy

Security telemetry frequently contains sensitive IP addresses, usernames, hostnames, and password hash attempts. Sending these logs to cloud-based LLM APIs presents significant data exposure risks.

CyberAI guarantees complete data residency by executing Qwen3-Coder 30B locally via Ollama on Kali Linux. Telemetry is parsed, correlated, and triaged entirely in an air-gapped local environment with zero external telemetry.

DOCUMENTED CORE ARCHITECTURE CAPABILITY

precision_manufacturing Local Inference + Security Tooling Integration + Agentic Task Automation

Bridges Kali Linux security tools with private local LLM reasoning via OpenCode and Ollama, transforming raw forensic streams into structured operational insight.

schema TELEMETRY ARCHITECTURE // 02

Documented System Architecture

Based on the documented architecture in the portfolio engineering specifications, CyberAI structures telemetry ingestion and local reasoning through an end-to-end pipeline:

analytics CYBERAI TELEMETRY INGESTION & REASONING PIPELINE LOCAL KALIX LINUX HOST

TIER 1 · TELEMETRY INGESTION

data_object Raw Log Streams

• Linux `auth.log` & Syslog
• Firewall Packet Dumps
• Security Tool Logs

Read-Only Log Ingestion

TIER 2 · PARSING & TIMELINE

schedule Event Normalization

• Regex & Token Parser
• Chronological Sequencing
• Heuristic Anomaly Flags

Structured Timeline Records

TIER 3 · LOCAL REASONING

neurology Qwen3-Coder 30B

• Ollama Inference Server
• Threat Correlation
• Contextual Risk Scoring

Private On-Device AI

TIER 4 · AUTOMATION & TRIAGE

integration_instructions OpenCode & Triage

• Multi-Agent Workflows
• Incident Reports
• Prioritized Alerts

Actionable Security Intelligence

RAW LOGS → NORMALIZATION & TIMELINE → LOCAL THREAT CORRELATION → AGENTIC AUTOMATION & TRIAGE

Component Breakdown & Data Flow

Component	Responsibility	Inputs	Outputs	Relationships
Log Parser & Normalizer	Extracts timestamps, hostnames, IPs, and event types from raw log files.	Raw log files (syslog, auth.log)	Structured JSON event stream	Feeds into Chronological Timeline Engine
Timeline & Anomaly Engine	Organizes events sequentially and applies heuristic threshold triggers.	Structured event stream	Chronological timeline with anomaly flags	Passes prioritized context to local AI model
Threat Correlation (Qwen3-Coder 30B)	Analyzes multi-stage event sequences to evaluate potential attack progression.	Incident timeline windows	Threat correlation summaries & risk scores	Hosted via local Ollama runtime
OpenCode Agent Integrator	Orchestrates multi-agent development workflows and automated analysis tasks.	Correlation output, user instructions	Automated tasks, investigative queries	Integrates with Kali Linux security utilities

route STEP-BY-STEP WORKFLOW // 03

Documented Operational Workflow

1 INPUT

Telemetry Streams

Raw system logs (such as authentication events, firewall connection logs, or tool dumps) are ingested into the platform.

2 PROCESSING

Parsing & Ordering

Events are structured into normalized schemas and chronologically ordered to form a coherent activity timeline.

3 DECISION

Threat Correlation

Qwen3-Coder 30B evaluates clustered events, correlating anomalous patterns (e.g. repeated auth failures followed by escalation).

4 ACTION

Agentic Triage

OpenCode agents dispatch follow-up verification tasks or query specific log subsets for deep contextual inspection.

5 OUTPUT

Incident Synthesis

Generates structured security incident reports with risk scores and actionable defensive remediation recommendations.

code IMPLEMENTATION DETAILS // 04

Technologies & Architecture Implementation

terminal Python Telemetry Engine

Engineered in Python with custom parsers for common Linux log formats (syslog, auth.log, auditd, iptables). Normalizes timestamps into unified UTC ISO-8601 records.

Modules: Python, Regex Parsers, Datetime Normalization

memory Local Inference Stack

Connects to a local Ollama instance running Qwen3-Coder 30B. Employs prompt templates designed for log analysis, root-cause identification, and attack sequence mapping.

Stack: Ollama, Qwen3-Coder 30B, Local GPU Offloading

precision_manufacturing OpenCode Agentic Workflows

Interfaces with OpenCode to automate multi-agent task execution, enabling security tasks to run as background workers while preserving state and context across analysis sessions.

Integration: OpenCode CLI / IDE, Background Tasks

security Kali Linux Security Tooling

Executes on a dedicated Kali Linux environment, bridging local intelligence directly with native command-line forensic utilities and security inspection tools.

OS: Kali Linux, Native Command-Line Forensics

Implementation details and parser modules are documented at the project repository. View Source Repository open_in_new

shield SECURITY CONTROLS & PRIVACY // 05

Data Isolation & Defensive Controls

visibility_off Telemetry Privacy

Operational logs and system authentication details remain on localhost at all times; zero prompt data is transmitted to cloud endpoints.

lock_open_right Read-Only Ingestion

Ingestion pipes operate with strictly read-only filesystem privileges, ensuring original system audit trails are never altered or damaged.

rule Safe Automation Boundaries

Analysis and triage tasks operate within authorized workspace directories, restricting background script execution to designated sandbox paths.

neurology AI MODEL INTEGRATION // 06

Local AI Model & Context Pipeline

CyberAI leverages Qwen3-Coder 30B served locally through Ollama. The model's large context window and strong code and structured syntax comprehension make it well-suited for security log interpretation:

Sliding-Window Log Analysis

Chunks continuous log streams into coherent temporal windows, allowing the model to detect coordinated activity distributed across multiple minutes or hours.

Contextual Threat Scoring

Synthesizes raw anomalies into qualitative severity flags (e.g. low-frequency reconnaissance vs. active credential brute-forcing) with transparent reasoning traces.

checklist TESTING & VALIDATION // 07

Testing & Telemetry Validation

The platform's log parsing and correlation modules are evaluated against synthetic and educational lab datasets:

check_circle Synthetic & Lab Telemetry Verification VERIFIED

Evaluated against simulated Linux authentication failure bursts, sudo privilege anomalies, and firewall connection drops to ensure accurate chronological reconstruction without dropped events.

Testing details, test event fixtures, and parser validation scripts are maintained in the project repository.

sync CURRENT STATUS // 08

Active Development

ACTIVE DEV // IN PROGRESS

Core log parsing, timeline ordering, and local Qwen3-Coder inference integrations are operational. Work is currently progressing on streaming socket ingestion and deeper OpenCode automation hooks.

update FUTURE ROADMAP // 09

Planned Improvements

[Planned] Real-time streaming ingestion via systemd-journald socket listeners.
[Planned] Automated Sigma rule matching integrated directly with local LLM threat correlation.
[Planned] Interactive timeline filtering UI rendered within the local OpenCode environment.

arrow_back Previous: Autonomous Pentesting Agent

Next Case Study: OpenCode Persistent Memory arrow_forward