Findings
What an agent has seen, with evidence: TITAN's anomaly detections, TIAID's intelligence matches. Every finding carries confidence, scope and the raw OCSF references behind it.
Home / Fusion Floor
The Fusion Floor
Most platforms hand your analysts four hundred raw alerts. CFC hands them one decision-ready case — because the Argus agents do the arguing first.
Live on the bus
One system. One conversation.
A simulated replay of an incident pattern moving through the orchestrated system — Intelliorbit (I.O) coordinating specialist capabilities end to end, with a human decision at the finish.
bus: connected · simulated replay — orchestrated system
The protocol
What travels on the bus
Agents don't share dashboards — they exchange three kinds of structured messages, every one of them logged and auditable.
Tasks
What an agent asks another to do: CORE tasking TIAID to enrich an indicator, or PACT to open an evidence chain. Tasks have owners, deadlines and outcomes — nothing is fire-and-forget.
Evidence
What survives for the record: sealed evidence chains, control mappings, the full agent conversation. This is what your auditors — and your lawyers — get when they ask "how do you know?"
Anatomy of a case
From first signal to one case
The same credential-stuffing replay from above, step by step.
Detection
TITAN spots an anomalous authentication burst across 14 accounts in one tenant — a credential-stuffing pattern, not 14 separate alerts.
Orchestration
I.O receives the finding, decides context is missing, and tasks TIAID: who owns this source infrastructure, and have we seen it before?
Enrichment
TIAID fuses threat-intelligence context: the infrastructure overlaps a known botnet cluster. Confidence: high. The finding is now an incident.
Evidence & compliance
I.O tasks PACT to seal the evidence chain and map the incident to the frameworks that matter — ISO 27001 controls, national IR reporting duties.
Case assembly
I.O assembles one decision-ready case: the finding, the intel, the evidence, the recommended action — with the full agent conversation attached.
Human decision
A human analyst reviews the fused case in the CFC console and approves containment. Agents propose — people decide. Always.
Governance
Autonomy with a paper trail
Multi-agent automation is only acceptable to a regulator — or a ministry — when every decision is explainable after the fact.
Human-in-the-loop
Containment and response actions require analyst approval by default. Autonomy thresholds are configurable per tenant, per action class.
Full audit trail
Every message on the bus — finding, task, evidence — is retained with the case. Reconstruct any decision, any time, message by message.
Tenant isolation
The bus is tenant-scoped: agents reason within a tenant's boundary, and cross-tenant visibility exists only for the roles you authorize.
See it live
Watch the Fusion Floor on your own data.
Book a walkthrough and we'll replay the agent bus against scenarios from your environment — Commercial or Sovereign.