AUTHORITATIVE
Rules and evidence
Original events, source identity, timestamps, reputation results, and correlation logic establish what was observed.
INTERPRETIVE
Granite / Scout
The model summarizes why evidence may matter, highlights relationships, and helps identify missed-signal risk.
The hard failure we caught
During testing, context contamination caused Granite to confuse the monitoring host with the source IP in a combined prompt. In security operations, confusing “who observed this?” with “who caused this?” can send an investigation in the wrong direction.
Engineering response: preserve source fields explicitly, bound the context passed to the model, and make explanations reviewable against original events.
Reasoning contract
Input: normalized events + enrichment + correlation evidence Output: significance, uncertainty, related signals, analyst next step Never: invent source identity, overwrite raw evidence, declare proof from score alone
Why local inference matters
The resource-conscious design keeps sensitive telemetry closer to the monitored environment and makes model behavior a component we can test, constrain, and observe.