Security Operations Centers (SOCs) must turn massive alerts, logs and traffic flows into trusted, cost‑effective decisions to uncover hidden threats. We introduce LanG 2.0, an agentic system that detects threats, correlates evidence and automatically writes rules. The key question is whether small local models can replace frontier models affordably and safely when structural safeguards—not raw model accuracy—provide the guarantees. LanG 2.0 incorporates entity‑anchored correlation, human approval for rule changes and a tamper‑evident ledger. Experiments span eight flow datasets from five networks, real XDR alerts and multi‑stage campaigns. Compared with its predecessor, campaign correlation precision rises from 18.75% to 51.81% and rule acceptance climbs from a maximum of 60.00% to 98.33%. Against Claude Opus 5.5, LanG 2.0 detects attacks on unseen networks with a 73.42% F1 score and zero false positives, while the competitor achieves 58.10% F1 with 49.00% false positives, using at least 650× less energy. Fine‑tuned local models match the large model statistically on alert classification and rule writing while consuming 5.6 to 59 times less energy. The system demonstrates practical scalability, processing 3.33 million records in 6.4 minutes and over 30 million per hour, and its safeguards resist prompt injection, label poisoning and ledger tampering. Thus, small local models can carry most SOC detection workloads affordably and safely.\n\nReview