Instructions to use sohomn/siem-log-generator-llama31-8b with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use sohomn/siem-log-generator-llama31-8b with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="sohomn/siem-log-generator-llama31-8b")
messages = [
    {"role": "user", "content": "Who are you?"},
]
pipe(messages)

# Load model directly
from transformers import AutoModel
model = AutoModel.from_pretrained("sohomn/siem-log-generator-llama31-8b", device_map="auto")

PEFT
How to use sohomn/siem-log-generator-llama31-8b with PEFT:
```
Task type is invalid.
```
Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use sohomn/siem-log-generator-llama31-8b with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "sohomn/siem-log-generator-llama31-8b"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "sohomn/siem-log-generator-llama31-8b",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/sohomn/siem-log-generator-llama31-8b

SGLang

How to use sohomn/siem-log-generator-llama31-8b with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "sohomn/siem-log-generator-llama31-8b" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "sohomn/siem-log-generator-llama31-8b",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "sohomn/siem-log-generator-llama31-8b" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "sohomn/siem-log-generator-llama31-8b",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Docker Model Runner
How to use sohomn/siem-log-generator-llama31-8b with Docker Model Runner:
```
docker model run hf.co/sohomn/siem-log-generator-llama31-8b
```

siem-log-generator-llama31-8b / dspy_log_generator.json

sohomn

Upload dspy_log_generator.json with huggingface_hub

de8d920 verified 5 months ago

Raw

History Blame Contribute Delete

9.18 kB

	{
	"generate.predict": {
	"traces": [],
	"train": [],
	"demos": [
	{
	"augmented": true,
	"structured_event": "{\"provider\": \"AWS\", \"action\": \"ACCESS\", \"entity_id\": \"user_alice\", \"target_id\": \"vm_021\", \"source_ip\": \"192.168.1.10\", \"region\": \"eu-west-1\", \"cloud_account\": \"acc_aws_123456\", \"status\": \"Success\", \"malicious\": 0, \"attack_phase\": \"benign\", \"edge_id\": \"user_alice__ACCESS__vm_021\", \"scenario_id\": \"scenario_00187\", \"t\": 18}",
	"reasoning": "User access to vm_021 is benign as user_alice is not malicious and the scenario is scenario_00187 which is not related to an attack.",
	"provider_log": "{\n \"eventVersion\": \"1.08\",\n \"eventTime\": \"2025-01-15T11:00:00Z\",\n \"eventSource\": \"ec2.amazonaws.com\",\n \"eventName\": \"DescribeInstances\",\n \"awsRegion\": \"eu-west-1\",\n \"sourceIPAddress\": \"192.168.1.10\",\n \"userAgent\": \"aws-sdk-python/1.34.0\",\n \"requestID\": \"E1C9C9C9C9C9C9C9C9C9C9C9\",\n \"eventID\": \"e0e0e0e0e0e0e0e0e0e0\",\n \"readOnly\": true,\n \"eventType\": \"AwsApiCall\",\n \"managementEvent\": false,\n \"userIdentity\": {\n \"type\": \"IAMUser\",\n \"arn\": \"arn:aws:iam::123456000000:user/alice\",\n \"accountId\": \"123456000000\",\n \"userName\": \"alice\"\n },\n \"requestParameters\": {\n \"resourceId\": \"021\",\n \"region\": \"eu-west-1\"\n },\n \"responseElements\": {\n \"requestId\": \"E1C9C9C9C9C9C9C9C9C9C9C9\",\n \"httpStatusCode\": 200\n },\n \"resources\": [\n {\n \"ARN\": \"arn:aws:iam::123456000000:vm/021\",\n \"accountId\": \"123456000000\",\n \"type\": \"AWS::EC2::Instance\"\n }\n ],\n \"errorCode\": null,\n \"errorMessage\": null,\n \"_pipeline_meta\": {\n \"edge_id\": \"user_alice__ACCESS__vm_021\",\n \"scenario_id\": \"scenario_00187\",\n \"t\": 18,\n \"malicious\": 0,\n \"attack_phase\": \"benign\",\n \"original_provider\": \"AWS\",\n \"is_cross_cloud\": false\n }\n}"
	},
	{
	"augmented": true,
	"structured_event": "{\"provider\": \"AWS\", \"action\": \"ACCESS\", \"entity_id\": \"user_bob\", \"target_id\": \"vm_012\", \"source_ip\": \"10.0.0.5\", \"region\": \"us-east-1\", \"cloud_account\": \"acc_aws_123456\", \"status\": \"Success\", \"malicious\": 0, \"attack_phase\": \"benign\", \"edge_id\": \"user_bob__ACCESS__vm_012\", \"scenario_id\": \"scenario_00467\", \"t\": 16}",
	"reasoning": "User bob is accessing vm_012 as part of a benign activity with scenario_id scenario_00467 at t=16. No malicious activity detected.",
	"provider_log": "{\n \"eventVersion\": \"1.08\",\n \"eventTime\": \"2025-01-15T10:40:00Z\",\n \"eventSource\": \"ec2.amazonaws.com\",\n \"eventName\": \"DescribeInstances\",\n \"awsRegion\": \"us-east-1\",\n \"sourceIPAddress\": \"10.0.0.5\",\n \"userAgent\": \"aws-sdk-python/1.34.0\",\n \"requestID\": \"E1C9C9C9C9C9C9C9C9C9C9C9\",\n \"eventID\": \"e2e0e0e0e0e0e0e0e0e0e0\",\n \"readOnly\": true,\n \"eventType\": \"AwsApiCall\",\n \"managementEvent\": false,\n \"userIdentity\": {\n \"type\": \"IAMUser\",\n \"arn\": \"arn:aws:iam::123456000000:user/bob\",\n \"accountId\": \"123456000000\",\n \"userName\": \"bob\"\n },\n \"requestParameters\": {\n \"resourceId\": \"012\",\n \"region\": \"us-east-1\"\n },\n \"responseElements\": {\n \"requestId\": \"E1C9C9C9C9C9C9C9C9C9C9C9\",\n \"httpStatusCode\": 200\n },\n \"resources\": [\n {\n \"ARN\": \"arn:aws:iam::123456000000:vm/012\",\n \"accountId\": \"123456000000\",\n \"type\": \"AWS::EC2::Instance\"\n }\n ],\n \"errorCode\": null,\n \"errorMessage\": null,\n \"_pipeline_meta\": {\n \"edge_id\": \"user_bob__ACCESS__vm_012\",\n \"scenario_id\": \"scenario_00467\",\n \"t\": 16,\n \"malicious\": 0,\n \"attack_phase\": \"benign\"\n }\n}"
	},
	{
	"augmented": true,
	"structured_event": "{\"provider\": \"AWS\", \"action\": \"ACCESS\", \"entity_id\": \"user_bob\", \"target_id\": \"vm_012\", \"source_ip\": \"10.0.0.5\", \"region\": \"us-east-1\", \"cloud_account\": \"acc_aws_123456\", \"status\": \"Success\", \"malicious\": 0, \"attack_phase\": \"benign\", \"edge_id\": \"user_bob__ACCESS__vm_012\", \"scenario_id\": \"scenario_00594\", \"t\": 2}",
	"reasoning": "User bob is accessing vm_012 as part of a legitimate activity.",
	"provider_log": "{\n \"eventVersion\": \"1.08\",\n \"eventTime\": \"2025-01-15T08:20:00Z\",\n \"eventSource\": \"ec2.amazonaws.com\",\n \"eventName\": \"DescribeInstances\",\n \"awsRegion\": \"us-east-1\",\n \"sourceIPAddress\": \"10.0.0.5\",\n \"userAgent\": \"aws-sdk-python/1.34.0\",\n \"requestID\": \"E1C9C9C9C9C9C9C9C9C9C9C9\",\n \"eventID\": \"e0c0c0c0c0c0c0c0c0c0c0\",\n \"readOnly\": true,\n \"eventType\": \"AwsApiCall\",\n \"managementEvent\": false,\n \"userIdentity\": {\n \"type\": \"IAMUser\",\n \"arn\": \"arn:aws:iam::123456000000:user/bob\",\n \"accountId\": \"123456000000\",\n \"userName\": \"bob\"\n },\n \"requestParameters\": {\n \"resourceId\": \"012\",\n \"region\": \"us-east-1\"\n },\n \"responseElements\": {\n \"requestId\": \"E1C9C9C9C9C9C9C9C9C9C9C\",\n \"httpStatusCode\": 200\n },\n \"resources\": [\n {\n \"ARN\": \"arn:aws:iam::123456000000:vm/012\",\n \"accountId\": \"123456000000\",\n \"type\": \"AWS::EC2::Instance\"\n }\n ],\n \"errorCode\": null,\n \"errorMessage\": null,\n \"_pipeline_meta\": {\n \"edge_id\": \"user_bob__ACCESS__vm_012\",\n \"scenario_id\": \"scenario_00594\",\n \"t\": 2,\n \"malicious\": 0,\n \"attack_phase\": \"benign\",\n \"original_provider\": \"AWS\",\n \"original_action\": \"ACCESS\",\n \"original_entity_id\": \"user_bob\",\n \"original_target_id\": \"vm_012\",\n \"is_cross_cloud\": false\n }\n}"
	},
	{
	"augmented": true,
	"structured_event": "{\"provider\": \"AWS\", \"action\": \"ACCESS\", \"entity_id\": \"user_john\", \"target_id\": \"vm_021\", \"source_ip\": \"192.168.1.10\", \"region\": \"eu-west-1\", \"cloud_account\": \"acc_aws_123456\", \"status\": \"Success\", \"malicious\": 0, \"attack_phase\": \"benign\", \"edge_id\": \"user_john__ACCESS__vm_021\", \"scenario_id\": \"scenario_00135\", \"t\": 6}",
	"reasoning": "User john accessed vm_021 as part of a benign activity.",
	"provider_log": "{\n \"eventVersion\": \"1.08\",\n \"eventTime\": \"2025-01-15T09:00:00Z\",\n \"eventSource\": \"ec2.amazonaws.com\",\n \"eventName\": \"DescribeInstances\",\n \"awsRegion\": \"eu-west-1\",\n \"sourceIPAddress\": \"192.168.1.10\",\n \"userAgent\": \"aws-sdk-python/1.34.0\",\n \"requestID\": \"E1C9C9C9C9C9C9C9C9C9C9C9\",\n \"eventID\": \"e0e0e0e0e0e0e0e0e0e0\",\n \"readOnly\": true,\n \"eventType\": \"AwsApiCall\",\n \"managementEvent\": false,\n \"userIdentity\": {\n \"type\": \"IAMUser\",\n \"arn\": \"arn:aws:iam::123456000000:user/john\",\n \"accountId\": \"123456000000\",\n \"userName\": \"john\"\n },\n \"requestParameters\": {\n \"resourceId\": \"021\",\n \"region\": \"eu-west-1\"\n },\n \"responseElements\": {\n \"requestId\": \"E1C9C9C9C9C9C9C9C9C9C9C9\",\n \"httpStatusCode\": 200\n },\n \"resources\": [\n {\n \"ARN\": \"arn:aws:iam::123456000000:vm/021\",\n \"accountId\": \"123456000000\",\n \"type\": \"AWS::EC2::Instance\"\n }\n ],\n \"errorCode\": null,\n \"errorMessage\": null,\n \"_pipeline_meta\": {\n \"edge_id\": \"user_john__ACCESS__vm_021\",\n \"scenario_id\": \"scenario_00135\",\n \"t\": 6,\n \"malicious\": 0,\n \"attack_phase\": \"benign\",\n \"original_provider\": \"AWS\",\n \"original_action\": \"ACCESS\",\n \"original_entity_id\": \"user_john\",\n \"original_target_id\": \"vm_021\",\n \"is_cross_cloud\": false\n }\n}"
	}
	],
	"signature": {
	"instructions": "Convert a structured cloud security event into a provider-native JSON log.\nOutput ONLY valid JSON with a _pipeline_meta field.\nNo explanation. No markdown. No code fences.",
	"fields": [
	{
	"prefix": "Structured Event:",
	"description": "JSON dict: provider (AWS/Azure/GCP), action, entity_id, target_id, source_ip, region, cloud_account, status, malicious (0/1), attack_phase, edge_id, scenario_id, t"
	},
	{
	"prefix": "Reasoning: Let's think step by step in order to",
	"description": "${reasoning}"
	},
	{
	"prefix": "Provider Log:",
	"description": "Valid JSON log. AWS: CloudTrail with eventSource, eventName, awsRegion, userIdentity, sourceIPAddress, _pipeline_meta. Azure: Activity Log with time, operationName, correlationId, identity, _pipeline_meta. GCP: Cloud Logging with protoPayload, resource, severity, timestamp, _pipeline_meta. _pipeline_meta must contain edge_id, scenario_id, t, malicious, attack_phase."
	}
	]
	},
	"lm": null
	},
	"metadata": {
	"dependency_versions": {
	"python": "3.12",
	"dspy": "3.1.3",
	"cloudpickle": "3.1"
	}
	}
	}