Threat Triage
A LangChain orchestration agent that triages security telemetry local-first, escalating only genuinely ambiguous cases to the cloud—a privacy-conscious alternative to sending every input straight to an LLM.
Problem
Processing sensitive security telemetry—logs, alerts, URLs, and threat text—usually means sending everything to a cloud LLM, which raises both privacy and cost concerns. Most inputs are routine classifications that never needed to leave the machine in the first place.
Approach
Threat Triage is a LangChain-based orchestration agent that routes triage tasks between a local and a cloud model, keeping clearly benign data on-device and escalating only when a case is genuinely ambiguous:
- Local tier: Every input is first classified locally by phi3 (3.8b) running via Ollama.
- Router: A routing step decides whether the local verdict is confident enough or whether the case warrants escalation.
- Cloud tier: Ambiguous cases are escalated to OpenAI (gpt-4o-mini) for a second opinion.
- Structured output: Both tiers return an identical JSON verdict—category, severity, reasoning, recommended action, source, and escalation status—validated with Pydantic.
Architecture & Usage
The agent runs in three modes:
- Single-shot CLI for one-off triage.
- Interactive REPL for exploratory analysis.
- Batch file processing with color-coded, severity-based output and summary statistics.
Setup uses uv for dependency management: install dependencies, pull the phi3 model through Ollama, add an OpenAI API key to .env, and run Ollama locally.
What I Learned
- Hybrid local/cloud routing: Designing a router that keeps routine classifications on-device while escalating only ambiguous cases balances privacy, cost, and accuracy.
- Consistent structured output: Enforcing an identical Pydantic-validated JSON schema across both tiers makes downstream consumption tier-agnostic.
- Privacy-first triage: Local-first processing meaningfully reduces the volume of sensitive telemetry sent to external services.