Alert volume is not the same as security understanding.
Meaningful risk often appears as a relationship between events, not as one dramatic log line.
Preserve evidence first. Enrich it second. Correlate it before asking an AI model to explain what it means.
Layered monitoring architecture
Async orchestration, configuration, ingestion, storage, web APIs, health checks, and operational workers designed to run on modest hardware.
Reputation-aware correlation
Wazuh telemetry, public reputation signals, and related events are joined into clusters so downstream activity can be evaluated in context.
Granite as a context layer
Granite 8B helps explain why a combined signal matters; it is not treated as the authoritative detector or source of evidence.
Operational evidence
The project includes detection rules, abuse.ch and URLhaus feeds, VirusTotal reputation enrichment, vulnerability/exploit correlation, a web dashboard, and automated tests.
Portfolio-safe presentation
This case study uses synthetic examples and omits real hostnames, addresses, credentials, and private infrastructure details.