HESP: Separating What to Probe from When to Stop in Local LLM Alert-Triage Agents.

arXiv:2609.33446v1 Announce Type: cross Abstract: Security operations centers receive far more alerts than analysts can investigate, and organizations that cannot send their telemetry to hosted models must automate triage with small open-weight LLMs on their o