Cases, evidence and explainable risk
Each case opens the agent's transparent pipeline: ATT&CK → evidence → explainable risk → response