| --- |
| base_model: Qwen/Qwen3-0.6B |
| library_name: peft |
| pipeline_tag: text-generation |
| tags: |
| - cybersecurity |
| - soc |
| - security-operations-center |
| - microsoft-sentinel |
| - azure-sentinel |
| - siem |
| - incident-response |
| - threat-hunting |
| - kql |
| - lora |
| - peft |
| - transformers |
| - conversational |
| license: apache-2.0 |
| --- |
| |
| # SOC7 — Natural Language SOC Assistant |
|
|
| SOC7 is a cybersecurity-focused conversational AI assistant designed to help Security Operations Center (SOC) analysts interact with Microsoft Sentinel using natural-language prompts. |
|
|
| Instead of requiring an analyst to manually construct every Kusto Query Language (KQL) query, SOC7 is designed to understand questions written in plain English and help translate them into Sentinel-oriented investigations. |
|
|
| For example: |
|
|
| > "Show me failed login attempts for the last 24 hours." |
|
|
| SOC7 can help generate the appropriate Sentinel/KQL investigation query and explain what the query is looking for. |
|
|
| > **Important:** SOC7 is a language-model adapter. It does not automatically connect to or access your Microsoft Sentinel environment by itself. A separate application, API integration, or agent workflow is required to execute generated queries against Sentinel. |
|
|
| --- |
|
|
| ## Model Details |
|
|
| ### Model Description |
|
|
| SOC7 is a lightweight LoRA adapter fine-tuned from `Qwen/Qwen3-0.6B` for cybersecurity and SOC-oriented conversational tasks. |
|
|
| The model is intended to assist analysts with: |
|
|
| - Natural-language to KQL translation |
| - Microsoft Sentinel investigation queries |
| - Security log analysis |
| - Alert investigation |
| - Threat-hunting questions |
| - Authentication and sign-in investigations |
| - IP and user investigation |
| - Basic incident-response assistance |
| - Explaining KQL queries in simple language |
| - Identifying useful Sentinel tables for an investigation |
| - Structuring SOC investigation workflows |
|
|
| ### Example |
|
|
| **Analyst:** |
|
|
| > Find users with more than 5 failed sign-ins in the last hour. |
|
|
| **SOC7:** |
|
|
| ```kql |
| SigninLogs |
| | where TimeGenerated >= ago(1h) |
| | where ResultType != "0" |
| | summarize FailedAttempts=count() by UserPrincipalName |
| | where FailedAttempts > 5 |
| | order by FailedAttempts desc |
