Towards Small Language Models for Security Query Generation in SOC Workflows