The more the agents can see, the better they judge

Integrations do two jobs in Zebrit: they send events in, and they give agents tools to check context during an investigation.

Identity and access

Sign-ins, MFA, password state, group changes.

[e.g. Microsoft Entra ID, Okta, Google Workspace]

Cloud platforms

Audit trails, configuration changes, resource metrics.

[e.g. AWS, Azure, Google Cloud]

Endpoint and EDR

Process, file and device events, host isolation.

[vendors to confirm]

Network and firewall

Flow logs, DNS, proxy and VPN events.

[vendors to confirm]

Metrics and APM

Forward alerts and metrics from tools you already run.

[e.g. Prometheus Alertmanager, webhooks]

CI/CD and change

Deploys and config changes for change-aware triage.

[e.g. GitHub, GitLab]

Ticketing and chat

Zebrit Incident Management built in, or send to your own tools.

[e.g. Jira, ServiceNow, Slack, Teams]

Threat intelligence

Public and commercial feeds checked per investigation.

[feeds to confirm]

Anything else

Syslog, webhooks and an API for custom sources and custom agent tools.