Given a natural-language security query, outputs a structured JSON routing decision telling the agent which tool to call, whether to use ReAct, and whether the query needs live data.

Output Schema

json

{
  "domain":       "wazuh",
  "needs_data":   true,
  "multi_source": false,
  "sources":      ["wazuh"],
  "tools": [{"name": "wazuh_query", "params": {"level_min": 7, "hours_back": 24}}],
  "output_mode":  "react",
  "rule_type":    null,
  "is_report":    false,
  "is_trivial":   false
}

Versions

Version	Epochs	Train Records	Domain Acc	output_mode Acc	Tool Acc
v1	3	1,889	84.3%	94%	87%
v2	+2	2,457	84.3%	92%	87%

v2 is a continuation of v1 (same LoRA weights, lower LR, domain-balanced data).

Training Data Sources

CFNemotron telemetry DB (gold/silver agent_runs)
MITRE ATT&CK enterprise techniques
SigmaHQ detection rules
Azure-Sentinel hunting queries
YARA-Rules repository
Targeted domain-signal examples (wazuh/sentinel/splunk/misp)

Known Limitations

Wazuh ↔ Sentinel ambiguity on queries without explicit source keywords (~6% of queries)
Rare domains (<2 val examples): azure_firewall, knowledge_base, misp routing to sentinel
reasoning domain indistinguishable from general (functionally equivalent)

Usage

python

from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer

tokenizer = AutoTokenizer.from_pretrained("ahmedcloudata/cfnemotron-routing-adapter", subfolder="v2")
base = AutoModelForCausalLM.from_pretrained("Qwen/Qwen3-1.7B", torch_dtype="bfloat16")
model = PeftModel.from_pretrained(base, "ahmedcloudata/cfnemotron-routing-adapter", subfolder="v2")