Here is exactly what happens inside Zebrit when 100 failed logins arrive in three minutes.
Your identity provider streams sign-in events to Zebrit. They are normalised, stored and searchable within seconds.
The "failed login burst" rule matches. In a legacy SIEM, this is where a brute-force ticket would be created and someone paged.
The agent loads the failed-login skill and lists the likely causes: password spraying, credential stuffing, a misconfigured service, or a user with a stale password.
It asks the identity provider about the account, geolocates the source, compares the client fingerprint and checks threat intel for the IP. All attempts come from one known laptop on the corporate VPN, three minutes after the password expired.
Benign: a mail client retrying an expired password. Under your policy for this rule, the agent may close it on its own.
No ticket is opened. The user gets a reset prompt, and the full investigation is kept in the audit log for review. Had any check pointed to an attack, a P1 incident would have opened with the same evidence.
Every verdict comes with its evidence, so mistakes are easy to spot. You choose which rules it may close alone, and you can reopen any closed alarm.
[Confirm Zebrit's data and model policy before publishing.]
Only if you allow it. By default agents have read access. Actions such as password resets need an explicit policy.
[Typical investigation time, measured on real customer data.]