Docs
Every rule, by name
Every rule a new workspace starts with, what it looks for, and how serious it is. Rules marked with a star can be set to Ask or Block.
Detection rules
Things an agent did. Shown on the Detections page, and on Threats when they landed on a weakness. Rules marked with a star can be set to Ask or Block.
| Rule | What it looks for | Severity |
|---|---|---|
| Agent acted after instructions arrived in tool output ★ | A command, fetch or write within thirty minutes of injected instructions | Critical |
| Agent tried to turn off ZYBE ★ | The sensor stopped or deleted, or the settings that connect an AI tool to ZYBE edited. Starts at Block. | Critical |
| ZYBE was uninstalled from an endpoint | The uninstaller ran and told the console, with who ran it | Critical |
| Agent safety control turned off ★ | An approval prompt or a permission setting switched off | Critical |
| Credential used, then the network ★ | A known credential went into a tool, then the same session reached the network | Critical |
| Same injected instructions on several endpoints | The same injected text on more than one endpoint in a day | Critical |
| Instructions to the agent in tool output | Text arriving in tool output that gives the agent instructions | High |
| Agent read a credential file ★ | A .env, an AWS or SSH key, a keychain export | High |
| Agent wrote to a startup or hook location ★ | A shell profile, a launch agent, cron, a git hook | High |
| Credential passed to a tool | A credential we know about went into a tool call | High |
| Data sent to a paste site, file share or webhook ★ | An upload to a paste site, a file share, a tunnel or a webhook host | High |
| Findings combine into an attack path | A way in, something worth taking, and a way out, on one endpoint | High |
| Forbidden permission held | A standing permission the detection profile forbids | High |
| Remote script piped into a shell ★ | A download went straight into a shell | High |
| Secret in tool output | A key, token or private key in what a tool returned | High |
| Secret pasted into the agent chat | A key, token, password or private key in the person's message or attachment | High |
| Agent ran a destructive command ★ | A recursive delete outside scratch paths, a force push, a table drop | Medium |
| Agent used elevated privileges ★ | sudo, or a write into system locations | Medium |
| Package installed from a URL, not a registry ★ | A git URL or a tarball, which no advisory feed covers | Medium |
| Agent installing packages in bulk | Ten or more packages in ten minutes | Medium |
| Package published in the last days | A package published within the last week | Medium |
| MCP server used minutes after it appeared | Used within an hour of appearing | Medium |
| Long run with nobody at the keyboard | Hundreds of tool calls over hours with nobody attending | Medium |
| A destination this endpoint has never used | A host nothing on the endpoint has reached before (learns for 7 days) | Medium |
| More tool calls than this agent normally makes | Against the agent's own baseline (learns for 7 days) | Medium |
| More subagents spawned than normal | Against the baseline | Medium |
| More tokens spent than normal | Against the baseline | Medium |
| Agent active outside its usual hours | Against the baseline (learns for 14 days) | Low |
| Agent installed a package | Every install, named, checked against the advisory feed | Low |
Risk rules
Things that are true. Shown on the Issues page until the configuration changes.
| Rule | What it looks for | Severity |
|---|---|---|
| Agent signed in as somebody who has left | The roster says this person has left | Critical |
| Endpoint belongs to somebody who has left | Same, for the machine's owner | Critical |
| Package flagged as malicious | A package the feed lists as malicious | Critical |
| Component judged malicious | A skill, subagent, plugin or extension a feed lists as malicious | Critical |
| Contained package still present | A package somebody blocked is still installed | Critical |
| Credentials an agent can read | Credentials sitting where any agent on the endpoint can read them | High |
| Credential in an MCP configuration | A credential in plain text in an MCP config | High |
| Same credential on several endpoints | The same value on more than one machine | High |
| Package with a known vulnerability | A published advisory against the installed version | High |
| Agent with a known vulnerability | Same, for the agent itself | High |
| Unapproved hook | A hook nobody approved, running on every tool call | High |
| Data access combined with egress | One endpoint holds data access and a way out | High |
| Endpoint has stopped reporting | Quiet for longer than its scan interval | High |
| Agent acts without asking | Standing approval for its tools | High |
| Agent may run shell commands without asking | Standing approval for the shell | High |
| Sessions running unobserved | Sessions the hook has not seen | High |
| Approved component changed | An approved skill no longer matches the text that was approved | High |
| Component can run commands and reach the network | Declares both | High |
| Component tells the agent to bypass approvals | A rules file or skill that tells the agent to skip approvals | High |
| Component judged suspicious | Judged suspicious when it was read | High |
| Critical detection left open | Open for more than 72 hours | High |
| MCP server over plain HTTP | Every call and its token cross the network readable | High |
| Local model server reachable from the network | Listening on every interface | High |
| Agent nobody shipped | A process talking to a model that is not an agent we know | High |
| Unreviewed components | New and not yet approved or blocked | Medium |
| Agent signed in with an unknown account | An account outside the company's domains | Medium |
| Agent runs unattended | Long sessions with nobody present | Medium |
| Endpoint has no owner | Nobody in the roster owns it | Medium |
| MCP server package not pinned to a version | Resolved fresh each time it starts | Medium |
| Agent far behind its current release | More than 90 days behind | Medium |
| Agent that can't be blocked | Offers no hook and no transcript | Medium |
| Hook reporting but no inventory scan | Calls arrive, the machine has never been described | Medium |
| Owner with unusually many endpoints | More machines than anyone else by a wide margin | Low |
| Configured but not installed | An agent's config exists with no agent behind it | Informational |
| Endpoint in no group | Governed only by the Default | Informational |
