nassimsai/llm-service repository overview

⁠LLM Service — NetworkPolicy Intelligence System

Part of the NetworkPolicy Intelligence System (NPI)⁠.

⁠What it does

Orchestrates the intelligence layer: reads audit_findings and anomaly_events, builds structured prompts, and calls a fully on-cluster LLM (llama3.2:3b via Ollama, CPU-only inference, no data ever leaves the cluster) to generate:

• Plain-English explanations of findings
• Likely attack-scenario framing
• Concrete YAML remediation suggestions
• Zero-Trust principle references

Responses are streamed back via Server-Sent Events (SSE) for a live "typing" chat experience in the dashboard. Includes a 168-hour deduplication window (keyed on anomaly_type + src_namespace + dst_namespace + dst_port) to avoid re-analyzing the same recurring issue.

Measured performance: 3.8s time-to-first-token, 11.3s full analysis.

⁠Tech

Python 3.11 (stdlib http.server, not FastAPI) · Ollama client · psycopg2 · TimescaleDB

⁠Quick start

docker pull nassimsai/llm-service:v1.0-pfe2026

Requires: DATABASE_URL env var, network access to an Ollama endpoint serving llama3.2:3b.

⁠Source & full deployment guide

https://github.com/nassim-saii/netpol-intelligence⁠