Sakeador

ThreatSage-12B

Deploy Dedicated

Dedicated Endpoints

Run this model inference on single tenant GPU with unmatched speed and reliability at scale.

Learn more

Get help setting up a custom Dedicated Endpoints.

Talk with our engineer to get a quote for reserved GPU instances with discounts.

README

License: apache-2.0

Key Features

🎯 Threat intelligence analysis — APT campaigns, IOCs, TTPs
🛡️ MITRE ATT&CK v16 tactic and technique classification
📋 Penetration testing report analysis and remediation advice
🔍 Incident response guidance and threat hunting support
👁️ Multimodal: analyze SIEM screenshots, network diagrams, security dashboards
🌍 Multilingual: English and Spanish

Model Details

Table
Property	Value
Base model	google/gemma-4-12b-it
Architecture	Decoder-only, encoder-free multimodal
Parameters	12B
Context window	256K tokens
Modalities	Text, Image, Audio, Video
Adapter	LoRA (r=32, alpha=64)
Precision	BF16
License	Apache 2.0

Training Data

Table
Dataset	Samples	Focus
reloading0101/threat-intelligence-dataset	52,279	CTI, APTs, IOCs, campaigns
sarahwei/cyber_MITRE_tactic_CTI_dataset_v16	14,008	MITRE ATT&CK v16
CJJones/Synthetic_PenTest_Reports	752	Pentest reports
Total	67,039

Usage

python
from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel
import torch

base_model = "google/gemma-4-12b-it"
adapter = "Sakeador/ThreatSage-12B"

tokenizer = AutoTokenizer.from_pretrained(base_model)
model = AutoModelForCausalLM.from_pretrained(
    base_model,
    torch_dtype=torch.bfloat16,
    device_map="auto"
)
model = PeftModel.from_pretrained(model, adapter)

messages = [
    {"role": "user", "content": "Analyze this Wazuh alert and identify the MITRE ATT&CK technique."}
]

text = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
inputs = tokenizer([text], return_tensors="pt").to(model.device)
outputs = model.generate(**inputs, max_new_tokens=512)
print(tokenizer.decode(outputs[0][inputs.input_ids.shape[1]:], skip_special_tokens=True))