Know what is arriving
Watch connected sources and their health. Follow each event from arrival through analysis on one clickable live page.
LOCAL SECURITY INTELLIGENCE
Your security.
Understood.
A security analyst beside your systems. Arbiter reads connected activity, separates routine signals from concerns, and explains what deserves your attention.
Local analysis. Readable evidence. Human control.
ARBITER / AN EXPLAINED DECISIONILLUSTRATION
Understand the signal.
Before taking action.
INCOMING ACTIVITYRepeated sign-in failuresConnected device → analysis → review
Raised for review
Why: repeated failures may warrant investigation. The original event and related evidence stay attached.
Alerting does not mean blocking.
Supported actions require your approval.
Supported actions require your approval.
01 Local by design02 Context before conclusions03 Every decision explained
LESS GUESSWORK. MORE UNDERSTANDING.
Built for the person
behind the alert.
For small teams and hands-on operators who need to understand security activity without maintaining a large analyst team.
Know why it matters
Open the event, verdict and evidence together. Filter history by source, event type, device, decision and response.
Keep control of response
Review supported proposals before they affect the device. Try isolated simulations without changing your real monitoring data.
ONE EVENT. A CLEAR JOURNEY.
From “what happened?”
to “here’s why it matters.”
A suspicious login is recorded. Arbiter checks it, explains its decision, and puts you in control of the next step.
- Observe. Your connected sources report activity.
- Check. Rules and context identify what needs attention.
- Explain. The event and decision stay linked.
- Review. You decide whether to approve a supported action.
INSIDE THE BRAIN
More than a model.
A system of checks.
Clear cases take the fast path. Ambiguous cases can reach local AI. Security checks surround the reasoning, while your environment’s context gives it meaning.
ARBITER / DECISION ARCHITECTUREAnalysis on your infrastructure
Connected activity
Windows events · Sysmon · osquery · network sensor logs · configured integrations
One common event formatDurable local queueRelated activity linked
THE DECISION ENGINE
Guardrails first
Check dangerous patterns before reasoning. A qualifying safety signal can go straight to review.
Rules & history
Use severity, asset importance and past decisions. Clear cases receive a decision here.
Clear case → verdictUnclear case → local reasoning
Local reasoning
An optional local model weighs the event against scoped facts and previous context.
Ollama model required for AIMock mode uses test heuristics
ENVIRONMENT MEMORY
↑ Context informs decisionsAsset importance · Scoped facts · Verdict history
Safety checks before the final verdict
Model failure or insufficient suppression confidence raises the event for review. A model cannot silently authorize protection.
Suppress the alert
Keep the event and written reason. Suppression does not delete activity or block a connection.
Raise for review
Show the event, related evidence, rationale and any supported response proposal together.
The operator owns the next step.
Eligible Windows IP blocks require explicit approval and expire after five minutes. Review feedback updates history; it does not retrain model weights.
For technical reviewers: contracts, boundaries & implementation
Stable event contracts
Collectors normalize into SecurityEvent v1.0, then adapt to the existing Event contract. Original payloads and provenance remain available for investigation.
Collection and reasoning stay separate
A bounded SQLite queue feeds one analysis worker. Collectors do not call the model. The decision engine produces verdicts; typed response operations remain separate.
Inspectable by design
Python core, SQLite state, local Ollama inference, and a React dashboard. Authenticated operational APIs use local accounts, session cookies and CSRF protection.
Honest engineering limits
This is an MVP: at-least-once processing, one worker per database, and a bounded correlation window. Source coverage and local model performance require validation in your environment.
A WORKING FOUNDATION. A CLEAR DIRECTION.
What it does today.
Where it goes next.
Arbiter is a development preview. The potential is broad; the current scope is specific and inspectable.
Monitoring → decisions → review
- Opt-in collectors for Windows/Sysmon, osquery, Suricata EVE, syslog and configured AWS sources.
- Local queue, limited event correlation, rules, security guardrails and optional Ollama reasoning.
- A live dashboard with linked event details, verdict rationale, evidence and filtered history.
- Isolated, paced dataset simulation with simulated responses.
- Explicitly approved, temporary Windows IP blocks for eligible local alerts.
Broader reach, earned carefully
- Uniform native installation and monitoring across Windows, Linux and macOS.
- Server deployment and management across multiple devices.
- Broader response operations with controlled permissions and stronger validation.
- More real-world evaluation, source coverage and operational hardening.
Running on one PC monitors its enabled sources. Whole-network visibility requires connected sensors or logs from other devices. Autonomous remediation is a future ambition.
MAKE IT YOURS
Start local.
Start with understanding.
Development preview.
Windows first. More platforms to follow.
01 Set up Arbiter locally02 Enable sources & permissions03 Review events in your dashboard
DEVELOPMENT PREVIEW
Windows
Local device monitoring, persistent state and a dashboard. Boot-time operation requires system setup and administrator approval.
Windows setup ↗Source builds available. Packaged downloads are not yet published.IN DEVELOPMENT
macOS
Native setup, background operation and device collectors are still to come.
UNDER VALIDATION
Linux
The Python core and systemd support exist. The full installation experience still needs validation.
Explore source ↗What should I know before setup?
Fresh installs start with collectors disabled. Enable only the sources you need and grant the permissions they require. The dashboard defaults to this device’s local address. Local AI needs Ollama and a configured model; mock mode is a deterministic development backend, not an AI model. Windows setup recommends at least 8 GB RAM and 8 GB free space for its local model option. Boot-time monitoring requires the device to be awake and powered on.
BEFORE YOU START
A few clear answers.
Does Arbiter replace my antivirus or firewall?
Arbiter currently adds monitoring, triage and investigation context. Keep your existing endpoint and firewall protections. It is not a full replacement for those controls.
Does it send my security events to a cloud AI?
The reasoning path uses local Ollama or development heuristics. Operational state stays in local SQLite databases. Optional cloud collectors retrieve data from the services you explicitly configure; they do not turn inference into a cloud AI service.
Will it block threats automatically?
Current ingestion does not automatically execute remediation. Eligible local Windows alerts can propose a five-minute IP block, which an administrator must explicitly approve. Other response types may be simulated or planned.
How can I judge whether it works?
Inspect the source and tests, connect a permitted source, generate a harmless test event, and verify its identity, verdict and rationale in the live dashboard. Use isolated dataset simulations to explore decisions. Validate coverage and local model behavior against your environment before relying on it.
Review the test suite ↗