Preprint Open access
HESP: Separating What to Probe from When to Stop in Local LLM Alert-Triage Agents
Security operations centers receive far more alerts than analysts can investigate, and organizations that cannot send their telemetry to hosted models must automate triage with small open-weight LLMs on their own hardware. Current LLM agents leave the investigation procedure to the model, and small local models fail at …