Security analysts deal with sensitive logs and potentially malicious code. Local LLMs are perfect for this.
1. Log Analysis
Paste anonymized server logs into the LLM.
"Analyze these Apache logs. Look for SQL injection attempts or suspicious user agent strings."
2. Deobfuscation
Malware often uses obfuscated code. Ask the LLM to explain it.
"Explain what this PowerShell script is doing step-by-step. Rename variables to be meaningful."
3. Writing Detection Rules
"Write a Sigma rule to detect a user adding themselves to the Domain Admins group in Windows Event Logs."
Alert triage at volume is a labelling task: a decision model returns a probability for each label, and calibrating its thresholds on your own alerts matters more than which model you pick. Decision models explained has the background.
Warning: Never execute malicious code generated or analyzed by AI without verifying it in a sandbox.