A LoRA fine-tuned adapter on Gemma 4 E4B for Security Operations Center (SOC) analysis. It explains security detection rules, interprets logs, and maps activity to MITRE ATT&CK techniques.

What it does

Explains Sigma detection rules
Interprets Windows Event Logs (EVTX) and Linux auditd events
Understands Wazuh alerts
Maps events to MITRE ATT&CK techniques
Produces structured SOC analyst assessments (Description, Severity, Log Source, MITRE tags)

Base Model

Base: google/gemma-4-E4B-it (~8B params)
Method: QLoRA (4-bit) fine-tuning
Trainable params: ~36.7M (0.46% of total)
LoRA rank: 16

Training Data

Fine-tuned on a combined cybersecurity dataset (~52,600 examples) covering Windows and Linux:

Source	Examples	Description
Windows chat	11,194	Detection rules + MITRE mapping
Linux auditd (refined)	15,000	Syscall / audit event analysis
Sigma rules	3,569	Sigma detection logic
Final train	11,194	General SOC instruction data
EVTX dataset	4,386	Windows event analysis
Atomic	5,553	Atomic Red Team techniques
Wazuh	1,713	Wazuh alert interpretation

Total: ~52,609 training examples (the Linux portion was refined from a raw corpus of over 2 million log entries down to high-signal auditd events).

Training Setup

Hardware: Kaggle Tesla T4 x2
Framework: Unsloth + TRL (SFTTrainer)
Steps: 400 (max_steps)
Batch: 2 x grad_accum 4
Learning rate: 2e-4, linear scheduler
Optimizer: adamw_8bit
Final training loss: ~0.13

How to Use

python

from unsloth import FastModel

model, tokenizer = FastModel.from_pretrained(
    model_name = "tareq052/cybersoc-gemma4-adapter",
    max_seq_length = 1024,
    load_in_4bit = True,
)
FastModel.for_inference(model)

Limitations

The Linux auditd training data was template-generated and shallow, so the model is strong at formatting and parsing but may under-assess threat severity on Linux events. Windows detection performance is stronger due to more varied source data.
This is a research/learning project, not a production security tool. Always verify outputs with a human analyst.

License

Apache 2.0 (inherited from Gemma 4).