ahmedcloudata/cfnemotron-routing-adapter

CFNemotron Routing Adapter (Qwen3-1.7B LoRA)

A LoRA adapter trained on Qwen3-1.7B that replaces the regex+LLM routing pipeline (layers 3–8) in the CFNemotron SOC query agent.

Given a natural-language security query, outputs a structured JSON routing decision telling the agent which tool to call, whether to use ReAct, and whether the query needs live data.

Output Schema

{
  "domain":       "wazuh",
  "needs_data":   true,
  "multi_source": false,
  "sources":      ["wazuh"],
  "tools": [{"name": "wazuh_query", "params": {"level_min": 7, "hours_back": 24}}],
  "output_mode":  "react",
  "rule_type":    null,
  "is_report":    false,
  "is_trivial":   false
}

Versions

v2 is a continuation of v1 (same LoRA weights, lower LR, domain-balanced data).

Training Data Sources

• —CFNemotron telemetry DB (gold/silver agent_runs)
• —MITRE ATT&CK enterprise techniques
• —SigmaHQ detection rules
• —Azure-Sentinel hunting queries
• —YARA-Rules repository
• —Targeted domain-signal examples (wazuh/sentinel/splunk/misp)

Known Limitations

• —Wazuh ↔ Sentinel ambiguity on queries without explicit source keywords (~6% of queries)
• —Rare domains (<2 val examples): azurefirewall, knowledgebase, misp routing to sentinel
• —reasoning domain indistinguishable from general (functionally equivalent)

Usage

from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer

tokenizer = AutoTokenizer.from_pretrained("ahmedcloudata/cfnemotron-routing-adapter", subfolder="v2")
base = AutoModelForCausalLM.from_pretrained("Qwen/Qwen3-1.7B", torch_dtype="bfloat16")
model = PeftModel.from_pretrained(base, "ahmedcloudata/cfnemotron-routing-adapter", subfolder="v2")