Can a local LLM triage security events?

Triage is a classification problem with a small output space: how bad is this, what kind of thing is it, and what should happen next. That shape looks like an easy win for a language model, and doing it locally means no event data leaves the machine — which is the part that makes it attractive for security work at all.

I wanted to know whether that actually holds up when something downstream has to act on the answer.