ConfigServer Security & Firewall (CSF): Alert Fatigue...

For those running ConfigServer Security & Firewall (CSF), the constant manual triage of lfd alerts gets old fast.

Built an LLM-driven analyzer that watches the same log sources CSF cares about. It correlates events, produces blast-radius summaries, then outputs ready-to-review csf.pl commands. Zero egress via local Ollama. Nothing applied without explicit confirmation.

Has anyone integrated similar tooling with CSF for high-signal triage? Feedback on false positive reduction welcome.

Here's the free community version repo on Github for testing - if interested.