Arbiter

Security teams drown in alerts, and in regulated environments, every dismissal or escalation needs a defensible reason, not just a gut call. Arbiter opens a shared adjudication room for every alert, orchestrated end-to-end: (1) an Orchestrator Agent routes each alert through enrichment, validation, and adjudication stages, (2) handing off to a Triage agent that gathers evidence, (3) a Prosecutor that argues the alert is a real incident, and (4) a Defender that argues it's a false positive, each citing only logged evidence and conceding when the facts turn against them. (5) A neutral Judge strikes any claim that cites evidence outside the bundle, sends the case back to Triage when context is missing, scores severity against a rubric, and escalates disruptive actions (isolating a host, disabling a credential) to a human analyst for approval. Lastly, a Diagnostics layer watches the pipeline and surfaces any caught errors, keeping the adjudication process transparent and debuggable end to end. The agents run on three different model vendors across two frameworks, so the Prosecutor and Defender are genuinely independent reasoners rather than one model arguing with itself. The result isn't a summary; it's a reasoned, citation-backed disposition that holds up in a SOC 2 review or breach post-mortem, with the full Band room serving as the audit trail.