Local 27B LLM Audits and Fixes Home Splunk-Sysmon SOC Stack Without Cloud Access

A security analyst studying for CySA+ used a locally hosted 27B quantised language model (Qwen3-27B) to audit and remediate a home SOC environment built on Splunk and Sysmon, with no data leaving the machine. The model successfully identified and fixed multiple issues across five audit sessions, including double log ingestion caused by a Universal Forwarder running alongside a local indexer, and three data inputs that had been silent since installation. Key root causes uncovered included disabled Windows event channels and misconfigured performance counters on a Spanish-language Windows install where English counter names were used. The model also demonstrated caution by flagging which MSI registry entry to avoid removing, preventing accidental deletion of the entire Splunk data directory. A notable limitation emerged when the model consumed 97.4% of its 128K context window over-investigating a minor detail, prompting the analyst to add a system-prompt rule to stop once root cause is confirmed with evidence.