trail-debug

Explain why an Agentmetry detection fired, or investigate a suspicious or missing event in the trail. Use when the user asks why a rule fired, why something was flagged, whether a finding is a false positive, or to trace an event through the trail.