Zebrit agents do what a good analyst does first: ask what else is true. They call skills and tools, read public knowledge, and come back with a verdict you can check.
Which rule fired, on what, and what that rule usually means.
Attack, misconfiguration, expected behaviour, broken integration.
Query logs, identity, assets, changes and threat intel to rule causes in or out.
Close, enrich, open a ticket or page a human, within your policies.
Packaged investigation playbooks: failed logins, privilege changes, malware hits, latency spikes, disk pressure. Edit them or write your own.
Identity provider, endpoint, cloud, CI/CD, CMDB and ticketing. Agents only use the connections and permissions you grant.
MITRE ATT&CK, CVE databases, threat feeds and vendor status pages, plus your own runbooks and past incidents.
Start in observe mode and widen autonomy rule by rule as trust builds.