Views
No views yet
| Property | Value |
|---|---|
| Base Model | Qwen/Qwen2.5-1.5B-Instruct |
| Method | QLoRA (r=16, alpha=32) |
| Training Data | SOC-AgentBench train split (84 episodes) |
| Max Length | 2048 tokens |
| Task | Tool-calling SOC investigation |
search_logs(query, start_time, end_time)get_host_context(hostname)get_user_context(username)lookup_mitre_technique(technique_id)enrich_ip(ip)build_timeline(events)submit_incident_report(report)1from transformers import AutoModelForCausalLM, AutoTokenizer
2
3model_id = "alirezaaminzadeh/soc-analyst-tool-use"
4tokenizer = AutoTokenizer.from_pretrained(model_id)
5model = AutoModelForCausalLM.from_pretrained(model_id, device_map="auto")
6
7messages = [
8 {"role": "system", "content": "You are a SOC analyst agent..."},
9 {"role": "user", "content": "Investigate: Suspicious LSASS memory access on WS-104"},
10]
11text = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
12inputs = tokenizer(text, return_tensors="pt").to(model.device)
13outputs = model.generate(**inputs, max_new_tokens=1024)
14print(tokenizer.decode(outputs[0], skip_special_tokens=True))| Metric | Score |
|---|---|
| Technique Macro F1 | 0.68 |
| Evidence Precision | 0.72 |
| Root Cause Accuracy | 0.58 |
| Tool Success Rate | 0.88 |