LLM Analysis

LLM Analysis (optional)

secwatch can send a compact evidence pack of recent traffic to any OpenAI-compatible endpoint and get back a plain-language assessment: a threat level, a summary, specific findings, and hardening recommendations. It appears in the dashboard's AI traffic analysis card.

This is off by default. Not every homelab runs an LLM, and secwatch is fully useful without one.

Enable

Point it at a local model (Ollama, vLLM, LM Studio, …) or a remote API:

llm:
  enabled: true
  base_url: http://127.0.0.1:11434/v1   # any OpenAI-compatible endpoint
  model: your-model
  api_key: ""                            # set for remote APIs; env var preferred
  alert_threat: elevated                 # alert at this threat level or higher

Keep secrets out of the file with SECWATCH_LLM_API_KEY. The install wizard will auto-detect a local OpenAI-compatible endpoint if one is running, but leaves LLM disabled until you turn it on.

What gets sent

A bounded evidence pack: aggregated traffic stats, top talkers/paths/user-agents (capped), and recent notable events — plus reverse-DNS for talkers. It does not ship your whole log. Review the size caps in the llm.* section of secwatch.example.yaml if you want to tighten what leaves the box, and prefer a local model if traffic metadata shouldn't go to a third party.

When it runs

• On an interval (default every 6h), after some traffic has accumulated.
• On demand — click Analyze now in the dashboard.

If the analysis rates the situation at or above alert_threat, secwatch sends an alert.

Steering it

Two site-config lists keep the analysis focused on your environment:

known_legitimate_endpoints:   # paths that are legit by design — don't flag
  - "/api/health"
active_mitigations:           # defenses already in place — don't re-recommend
  - "Cloudflare in front of all public hosts"

LLM output is advisory — verify before acting on a recommendation.