Egregoros

@sun @whiteline @ageha I've spent the past week+ using an llm to build a tool that acts as a canary to protect against credential theft from supply chain attacks (i.e. miasma) and helps build app armor profiles for the applications you use by watching audit logs, classifying and grouping events, and providing suggested rules that can be applied iteratively with explanations generated by a local llm server. It's not done yet, but the idea is to make mandatory access control something more people can take advantage of eventually. It's not done yet, but some of the biggest hitting features (like clustering/grouping events) have been working almost since day 1. Mostly now it's about tuning the rails so the llm doesn't hallucinate garbage suggestions, and I'm collecting all of the input, output, and finalized profile data so that I can try my hand at fine tuning a model specifically for this purpose.