The first 26 hours
What does a rules-first security monitor flag on its first day on a real network?
Three alerts worth a look in 26 hours, and none of them an attack. Two came from a pair of phones the network controller kept confusing with each other. The third was a Wi-Fi impersonation warning I have not explained yet, because I have not had time to look at the code, the model output, or the access point itself. The local model called the phone alerts likely benign and sent the impersonation warning to me.
- Measured on
- Mac Studio · Apple M2 Max · 96 GB
- Model
- Qwen 3.8-27B · MLX 8-bit
- Published
- · updated
778 polls in 26 hours, and not one of them failed. The Mini SOC went live on 25 September 2026 and read the network controller every two minutes from then on.
Most of what a home network logs is devices coming and going. Over eight days the controller recorded 1,087 events, and 17 of them were anything other than a device connecting, disconnecting or roaming between access points. About two a day. That is the volume the rules actually work on.
Three alerts, no attacks
| Alert | Rule | Model’s assessment | What it was |
|---|---|---|---|
| Hostname changed on a phone | Label changed | Likely benign | The controller swapping two phones’ names |
| Hostname changed back | Label changed | Likely benign | The same swap, reversed |
| WiFi Impersonation Detected | UniFi security event | Needs review | Unresolved: not one of my access point’s radio addresses |
The model took between 20 and 83 seconds per alert on the Mac Studio. It never closed anything. It can’t.
The phones that traded names
Two phones in the house have near-identical names, and the controller kept attaching one phone’s name to the other’s hardware address. It did that 77 times in 26 hours.
I’d already added a filter for this before launch: a hostname change only counts once it shows up on two polls in a row. It wasn’t enough, because many of the swaps lasted longer than the two minutes between polls. What kept this down to two alerts was a second rule: one alert per new name per device, ever. 77 swaps, two alerts.
The next fix gives the model the fact it was missing. When a device’s new name already belongs to another device on the network, the alert will say so.
The devices that weren’t there
This one showed up before launch, in a dry run on a saved copy of the network. The monitor flagged 16 “recently added devices” to confirm. None of them was connected. The controller keeps a record of every device it has ever seen, and these were history: half of them phones or watches on private Wi-Fi addresses that had since rotated to new ones.
Two changes came out of it. The first-run check now looks only at devices that are actually connected. And a new device with a private address shows up in the widget without sending a notification, because modern phones rotate those addresses by design and every rotation looks like a new device. A new device with a manufacturer’s address still notifies. Without that, every houseguest would page me.
The field I threw away
The impersonation warning says a third-party access point was broadcasting a Wi-Fi network. The access point’s hardware address looked like my own access point’s address with the private bit set, which is how access points number their extra networks. I read that as my own hardware. It isn’t: the address is not one of my access point’s configured radio addresses. What it is, I don’t know yet. I haven’t had time to look at the code, the model output, or the access point itself (correction, 3 October).
The model couldn’t see that. My structuring layer had dropped the address, because UniFi’s message template for this event doesn’t mention it, and the layer only passes fields the template uses. I wrote that rule after an unexplained number led the model to invent a meaning for it. Here the same rule removed the one piece of evidence the question turned on.
Cleaning data for a model is a trade. Every field you drop is one the model can’t misread and one it can’t use. The model said “needs review” and was right to. The fix is mine, not the model’s.