Lab 1 of 17 · By Michael Stout
In this lab
Use Copy beside a command to copy it exactly.
Install Ollama and run DeepHat-V1-7B on Windows
Chapter 1 covers where AI helps a security analyst, and where it can hurt you. This lab puts that on your own machine: you'll install Ollama, a free tool for running large language models locally, then download DeepHat-V1-7B — a model fine-tuned specifically for cybersecurity and DevOps work. Nothing you type leaves your computer.
Keep sensitive data on your own machine
Chapter 1 names data exposure as one of the four AI risks analysts have to manage: pasting logs, artifacts, or other sensitive material into a public AI tool can mean that data is stored, reused, or exposed by a third party. A model running through Ollama processes everything on your own hardware. There is no account, no upload, and no third-party server in the loop.
Running locally closes off data exposure. It does not close off hallucination. Treat DeepHat's answers the same way Chapter 1 tells you to treat any AI output — as a draft you verify, not a finding you report.
What you'll need
Windows 10, version 22H2 or later, or Windows 11 — 64-bit.
8 GB RAM minimum; 16 GB is recommended for a smoother 7-billion-parameter model.
At least 20 GB free. The model download alone is roughly 15 GB.
Local administrator rights, to run the Ollama installer.
A stable connection for two one-time downloads: the ~1.6 GB installer and the ~15 GB model.
20–40 minutes total, most of it spent waiting on the model download rather than typing.
Get the engine running
- Download the installer. In a browser, go to
ollama.com/download/windowsand select Download for Windows. This savesOllamaSetup.exe, about 1.6 GB. - Run the installer. Double-click
OllamaSetup.exe. If Windows asks for permission to let it make changes, allow it. Follow the prompts to completion — there are no configuration choices to make. - Confirm it's running. Ollama starts automatically once installation finishes and adds an icon to the system tray. In the background, it starts a service that listens on
http://localhost:11434— that's how other programs, and the commands below, talk to it. It restarts automatically every time you sign in. - Check the version. Open PowerShell (search “PowerShell” from the Start menu) and run:You should see a version number reported back. If PowerShell says the command isn't recognized, sign out and back in so Windows picks up the change, then try again.
ollama --version
Pull DeepHat-V1-7B
- Start the download. In the same PowerShell window, run:
ollama pull DeepHat/DeepHat-V1-7B
- Wait it out. This transfers roughly 15 GB, so it will take a while — the exact time depends on your connection. Leave the window open until it reports the pull is complete.
- Confirm it's on disk. Run
ollama list.DeepHat/DeepHat-V1-7Bshould appear in the table with its size and the date it was pulled.
Chat with the model
- Start a session. Run:
ollama run DeepHat/DeepHat-V1-7B
- Ask it something. At the
>>>prompt, type a question and press Enter — try “Explain the difference between a vulnerability and a threat in one sentence.” The first reply is slower while the model loads into memory; after that it should feel conversational. - Exit when you're done. Type
/byeto leave the chat and return to PowerShell. - Optional housekeeping.
ollama psshows which models are currently loaded in memory.ollama stop DeepHat/DeepHat-V1-7Bunloads it and frees RAM without deleting the download.
Six prompts worth running
| Maps to | Prompt |
|---|---|
| Ch. 3 · Malicious activity | “A user's laptop fans run constantly and netstat shows an established connection to an unfamiliar IP on port 4444. What should I check next, and how would you classify this indicator?” |
| Ch. 7 · Vulnerability scans | Paste in a CVE description from nvd.nist.gov: “Summarize this vulnerability in plain English, and tell me how urgently it should be patched and why.” |
| Ch. 4 · Threat intelligence | “An attacker created a scheduled task that runs PowerShell at every login. Which MITRE ATT&CK technique does this map to, and what's one way to detect it?” |
| Ch. 2 · System architecture | “Write a PowerShell one-liner that lists every local user account created in the last 7 days.” |
| Ch. 10 · Evidence and analysis | “Write a script that reads a Windows Security event log export and counts failed logon attempts (Event ID 4625) by source IP.” |
| Ch. 12 · Reporting | “Turn these three bullet points of incident notes into a short paragraph a non-technical stakeholder could read.” (Paste in three bullets of your own.) |
Two things to keep in mind
DeepHat can still invent a CVE ID, a command flag, or an ATT&CK technique that doesn't exist — the same hallucination risk Chapter 1 covers for any AI tool. Check anything before you act on it or put it in a report.
Run this lab, and try the example prompts, on a personal or lab system rather than a production endpoint — the same guidance this course gives for every other hands-on lab.
Sources. Ollama, download and installation guidance for Windows, ollama.com/download/windows. Ollama, DeepHat/DeepHat-V1-7B model page and pull command, ollama.com/DeepHat/DeepHat-V1-7B. DeepHat, model card (architecture, license, intended use), huggingface.co/DeepHat/DeepHat-V1-7B. The model carries an Apache-2.0 license plus DeepHat's extended usage terms, which rule out military, discriminatory, and fully-automated high-impact uses — worth a read before deploying it beyond this lab. Installer size, download size, and default file paths are current as of September 2026 and can change between Ollama releases; re-verify against the pages above before teaching this lab live.