{"repo":"aaronphifer/triagewall","free":true,"listed":false,"github":"https://github.com/aaronphifer/triagewall","clone":"git clone https://github.com/aaronphifer/triagewall.git","description":"Local-LLM alert triage for self-hosted SOCs.","language":"Python","stars":11,"topics":["homelab","ids","llm","ollama","security","self-hosted","selfhosted","siem","suricata","wazuh"],"license":"AGPL-3.0","category":"self-hosted-apps","readme_excerpt":"TriageWall Local-first AI alert triage for Suricata and Wazuh. Reduce security noise without sending telemetry to the cloud. Get started · Documentation · Latest release 99%+ typical policy resolution after tuning · 100% local with no alert telemetry · 266-alert approved release evaluation Why TriageWall? Suricata and Wazuh are excellent sensors, but high-volume alerts still leave an operator with a prioritization problem. TriageWall adds a local decision layer: validated deterministic policy handles known repeat noise, a local security model reviews the long tail, and a source-aware workbench keeps the final decision with the operator. TriageWall is built for self-hosted security teams, homelab operators, and small environments that want useful triage without uploading alert evidence to a cloud model. It reads from your sensors and records decisions; it does not block traffic, change sensor rules, or take autonomous response actions. Product capabilities - One review queue for Suricata and Wazuh. Preserve source, event, rule, agent, and network context instead of flattening every sensor into one shape. - Two-tier local classification. Resolve carefully scoped repeat noise in microseconds and send only the residual long tail to a local Ollama model. - Analyst investigation views. Review recurrence, related activity, source-specific evidence, and queue-aware Previous/Next navigation. - Bounded alert search. Find retained alerts by signature, exact IP address, or historical ass","default_branch":null,"files":null,"tree":[],"storefront":"/r/aaronphifer","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/aaronphifer/triagewall/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}