CrowdStrike’s Journey in Customizing NVIDIA Nemotron Models for Peak Accuracy and Performance

CrowdStrike is collaborating with NVIDIA to optimize NVIDIA's Nemotron models for enhanced security operations, focusing on adapting large language models (LLMs) for security-specific workloads while maintaining high performance and security. This effort includes creating a natural language-to-CrowdStrike Query Language (CQL) translation model by utilizing real-world queries and synthetic data generated with NVIDIA NeMo Data Designer. The project addresses challenges like query duplication and privacy concerns by employing techniques such as deduplication using Abstract Syntax Trees (ASTs) and a custom PII scrubbing pipeline. By fine-tuning models like Llama Nemotron Super 49B, CrowdStrike achieved significant gains in query validity and semantic accuracy, enabling analysts to concentrate on threat investigation rather than query syntax, thus enhancing efficiency in security operations. The ongoing collaboration aims to further explore NVIDIA's Nemotron 3 models to optimize performance, cost, and capability balance in security operations across various use cases.