HassanShehata/logem

LLMSIEM/logem: Specialized for SIEM Field Extraction

LLMSIEM/logem is a 0.6 billion parameter language model, fine-tuned by Hassan Shehata from Qwen3-0.6B, specifically for Security Information and Event Management (SIEM) tasks. This model demonstrates that targeted fine-tuning can achieve superior performance on domain-specific tasks, outperforming much larger general-purpose models in SIEM field extraction.

Key Capabilities & Performance Highlights

• Best-in-class SIEM Field Extraction: Achieves 66.7% perfect matches and an 0.833 F1 score for structured field extraction from security logs, surpassing 12B parameter models.
• High Efficiency: Operates with an average response time of 1.00s, making it 3x faster than larger alternatives, and is 12.6x smaller than models like Gemma:12B while maintaining superior performance.
• Optimized for Cybersecurity: Specifically trained on a curated dataset of network security events, authentication logs, system security events, and application security logs.
• Resource-Efficient: Available in FP16 (1.2 GB) for maximum accuracy and a quantized Q4_K_M version (396 MB) for resource-constrained deployments, with only a 5% accuracy reduction.

Ideal Use Cases

• Extracting structured fields from diverse security logs and events.
• Parsing and normalizing security event data for SIEM platforms (e.g., Splunk, ELK).
• Automating log analysis workflows and generating structured outputs from unstructured security data.
• Integration into SOAR workflows for threat hunting and incident response automation.

Limitations & Recommendations

The model is optimized for security log formats seen during training and may struggle with completely novel or unusually formatted logs. It is not suitable for general-purpose text generation or real-time critical security decisions without human oversight. Validation of model outputs and regular retraining are recommended for production environments.