EryriLabs/Glimmer-Sentry-30B

VISIONPricing:Input $1.2 / Cached $0.04 / Output $4.4Concurrent Unit Cost:2Model Size:30BQuant:FP8Context Size:128kPublished:Aug 13, 2026License:apache-2.0Architecture:Transformer Open Weights Featherless Exclusive Cold

EryriLabs/Glimmer-Sentry-30B is a 30 billion parameter QLoRA fine-tune of Muse-Glimmer-30B, specifically designed as a local detection-engineering copilot. It excels at translating and authoring security detection rules (Sigma to KQL, SPL, YARA, Wazuh) and explaining them, running efficiently in 4-bit quantization on a single 24GB GPU. This model is optimized for security teams without a Security Operations Center (SOC) to manage and generate detection logic on-premise.

Loading preview...

Glimmer-Sentry-30B: Local Detection-Engineering Copilot

EryriLabs/Glimmer-Sentry-30B is a 30 billion parameter QLoRA fine-tune of Muse-Glimmer-30B, engineered to serve as a local copilot for detection engineering. It addresses the challenge faced by small security teams needing to translate and manage detection rules without relying on cloud-based solutions.

Key Capabilities

  • Cross-Format Rule Translation: Translates Sigma rules to KQL (M365 Defender) with 80% exact match and SPL (Splunk) with 90% exact match, based on sigma-cli ground truth.
  • Rule Authoring: Generates new Sigma and YARA rules from descriptions, tags, and log sources. Achieves 76% success for parsable and valid Sigma rules.
  • Rule Explanation & Tuning: Explains existing rules for various audiences and suggests tuning modifications based on false-positive fields.
  • Efficient Local Deployment: Runs in 4-bit quantization, fitting on a single 24GB GPU (e.g., RTX 3090/4090), enabling on-premise operation.
  • Multimodal Base: While fine-tuned for text, it leverages a multimodal base with a frozen vision tower.

Performance Highlights

Evaluated on 50 held-out Sigma rules, the model demonstrates strong performance in translation tasks. YARA authoring is noted as a weaker spot, with 57% compile rate at a 1536-token budget. The training data included a mix of translation pairs, rule authoring, explanations, and general instructions, ensuring general chat capabilities were preserved.

Good for

  • Security teams without a SOC needing to manage detection logic locally.
  • Translating existing Sigma rules to KQL or SPL.
  • Generating new detection rules (Sigma, YARA) from natural language descriptions.
  • Understanding and tuning security detection rules.

Finetunes
2 models