Qwen3-Powered Log Classification for Improved SOC Decision-Making

In today's rapidly evolving threat landscape, enterprises must remain resilient by gaining rapid insight into-and promptly neutralising-emerging cyber-attacks. Most organisations outsource protection to external Security Operations Centers (SOCs), where analysts manually inspect enormous, heterogeneous streams of security logs. Traditional rule-based techniques can no longer cope with the explosive growth in log volume and complexity, producing "alert-fatigue" that jeopardises business continuity. Large Language Models (LLMs), equipped with cross-domain semantic understanding and text-generation capabilities, present a promising avenue for automating log analysis and classification. This study adopts Qwen3-8B-Instruct and designs three tiers of prompt complexity-low, medium, and high-to label security logs as benign or malicious in zero- and few-shot settings. Medium- and high-complexity prompts enable Qwen3 to identify most benign events, yet sophisticated malicious traces still evade detection. We therefore propose context aggregation, anomaly-pattern injection, and incremental fine-tuning to close the gap. Embedding such techniques in an SOC workflow can relieve analysts from rote triage, allowing them to focus on high-value forensics and rapid incident response.