Fine-tuned local model for SOC alert triage: false escalations fell after training on real noise

A developer built a SOC alert triage helper using a fine-tuned Gemma 4 E2B model that runs locally on an 8 GB GPU so logs never leave the network. Initially the model scored perfectly on synthetic tests but escalated 39 of 100 real Wazuh lab alerts for nothing. Adding 215 real benign cases to training cut false escalations to zero on the held-out real set. The author also added deterministic filtering that handles most alerts before the model is called, and per-alert JSON schemas to enforce valid evidence citations. The results do not prove recall on real attacks, since the real test set contains only benign noise. Some test cases also closely resemble training data.