Kezekshi L1

Kezekshi L1 is an open-source local L1 SOC triage agent filters Wazuh alerts and uses a fine-tuned Gemma model to prepare investigation cards.

Kezekshi L1 is an open-source local L1 SOC triage agent that operates on top of Wazuh to process security alerts without sending data externally. The system uses deterministic white-list rules to remove operational noise and routes the remaining ambiguous alerts through a fine-tuned Gemma 4 E2B model. The model generates an investigation card for the second security line that includes a verdict, claims with evidence links, MITRE ATT&CK techniques, and checks. The codebase includes circuit code, the response schema, an ATT&CK index, training and evaluation scripts, and an operator guide. It runs locally using Python and Ollama, and requires 8 GB of video memory.

Kezekshi L1 at a glance

Best for: Software engineer
Runs on: self-hosted, open source
Pricing: Free and open-source under the Apache 2.0 license.
Released: November 2026
Category: AI agent tool
Website: github.com/oleg-vdv/kezekshi-l1

Key features

Filter operational noise with deterministic rules
Process ambiguous alerts with fine-tuned Gemma 4 E2B
Generate investigation cards with verdicts and evidence
Map security alerts to MITRE ATT&CK techniques
Run locally via Python and Ollama without sending data out
Train and evaluate custom models with provided scripts

Use it for

Filter operational noise from Wazuh security alerts
Triage ambiguous security alerts for tier-two analysts
Prepare investigation cards with verdicts and MITRE techniques
Run local SOC triage without exposing data externally

Alternatives to Kezekshi L1

Full Chain Sentinel System — It runs authorized penetration tests with a containerized Kali environment and web console.
Vigil — Drives end-to-end security engagements with specialist agents and a shared Kali container.
Waku Agent — Local-first memory storage and readable Python code for AI agent logic.
Kilasec — Stops runaway spend and masks sensitive data without modifying agent code.
OpenSquilla — Maximizes AI intelligence density while minimizing token costs through smart routing.
Kodama — Provider-neutral multi-agent workflows for the Kiro CLI with persistent project memory.
Nasiko — Control enterprise AI agent costs, permissions, and multi-model execution from one place.
Melra — Governs AI agent tool calls with local policies, approval gates, and verified receipts.
FakeLiang — Verifies attack paths step by step with traceable call records and evidence.
Rufous — It runs locally, checks small model tool calls, and asks before making system changes.
Rashomon — Verifies whether Claude Code actually completed tasks or hid command failures.
Phocinae-Largha-150M-v1（斑海豹 Largha） — Runs locally with zero generated tokens and high decision speed.

All Kezekshi L1 alternatives