Context
The classifier uses few-shot examples in harbinger/prompts.py to anchor small models toward consistent labels. SonicWall is a common SMB firewall and its log format isn't currently represented in the anchor set — operators with SonicWall traffic see lower confidence and more unknown rows than they need to.
Scope
Add one or two few-shot examples covering a typical SonicWall firewall event (connection denied, IDS detection, etc.) to FEW_SHOT_EXAMPLES in harbinger/prompts.py. The structure follows the existing entries: a {"role": "user", "content": "<raw syslog line>"} paired with {"role": "assistant", "content": '<json result>'}.
A representative SonicWall line looks roughly like:
<132>Jul 14 09:00:14 fw-edge sn=18B169 time="2026-07-14 09:00:14" fw=198.51.100.1 pri=4 c=8 m=82 msg="Connection denied" n=12498 src=203.0.113.42:54311 dst=10.0.5.12:445 proto=tcp/microsoft-ds
Expected classification: {"log_type": "firewall-deny", "signal_grade": "medium", "tier_recommendation": "basic", "confidence": 0.9} or similar.
Acceptance criteria
Why this is a good first issue
Touches one file. Small, focused diff. Demonstrates the design pattern (prompt as tuning surface — see the post in docs/BLOG_IDEAS.md § 9 for the philosophy). Gives the contributor real-world impact for any operator with SonicWall traffic.
Context
The classifier uses few-shot examples in
harbinger/prompts.pyto anchor small models toward consistent labels. SonicWall is a common SMB firewall and its log format isn't currently represented in the anchor set — operators with SonicWall traffic see lower confidence and moreunknownrows than they need to.Scope
Add one or two few-shot examples covering a typical SonicWall firewall event (connection denied, IDS detection, etc.) to
FEW_SHOT_EXAMPLESinharbinger/prompts.py. The structure follows the existing entries: a{"role": "user", "content": "<raw syslog line>"}paired with{"role": "assistant", "content": '<json result>'}.A representative SonicWall line looks roughly like:
Expected classification:
{"log_type": "firewall-deny", "signal_grade": "medium", "tier_recommendation": "basic", "confidence": 0.9}or similar.Acceptance criteria
FEW_SHOT_EXAMPLEScovering SonicWall firewall events.tests/test_prompts.py(ortests/test_classifier.py) that asserts the new anchors are well-formed JSON and use the documented enum values forsignal_gradeandtier_recommendation.pytest -qstill reports 215 pass / 1 skip).Why this is a good first issue
Touches one file. Small, focused diff. Demonstrates the design pattern (prompt as tuning surface — see the post in
docs/BLOG_IDEAS.md§ 9 for the philosophy). Gives the contributor real-world impact for any operator with SonicWall traffic.