Build a local firewall log pipeline on Windows with NXLog and SQLite, then let Cursor query it read-only — no SIEM required.