blackpoint

Investigate a single Blackpoint Cyber / CompassOne detection end-to-end

Portfolio-level Blackpoint Cyber / CompassOne rollup of detections and exposure across all tenants

List recent Blackpoint Cyber detections for a tenant

Build a prioritized exposure report for a Blackpoint Cyber / CompassOne tenant

Sweep and prioritize the open Blackpoint Cyber / CompassOne detection queue across tenants

Use this agent when triaging the Blackpoint Cyber / CompassOne detection queue across one or many tenants — ranking open detections by severity and tenant impact, deciding what needs immediate escalation to the Blackpoint SOC versus routine follow-up, and producing a prioritized response plan. Trigger for: triage Blackpoint detections, CompassOne queue, prioritize Blackpoint alerts, what should I work first Blackpoint, Blackpoint escalation, detection response plan, multi-tenant detection sweep. Examples: "Triage all open Blackpoint detections and tell me what to escalate", "What's the highest-priority detection across our CompassOne tenants?", "Build a response plan for today's Blackpoint queue", "Which tenants have new critical detections this morning?"

Use this agent when investigating a Blackpoint Cyber / CompassOne MDR detection — reconstructing what fired, drilling from tenant to affected asset, mapping the asset's relationships to estimate blast radius, and cross-referencing vulnerabilities and dark-web exposure for context. Trigger for: investigate Blackpoint detection, what happened CompassOne, Blackpoint incident, Blackpoint MDR alert, detection triage Blackpoint, blast radius, asset relationships Blackpoint, Blackpoint forensics. Examples: "Investigate this CompassOne detection on the Acme tenant", "What's the blast radius of the detection on WS-042?", "Walk this Blackpoint detection end-to-end and tell me what's affected", "Pull the vulnerability context for the asset behind detection D-1234"

Use this agent when assessing a tenant's attack-surface and exposure posture in Blackpoint Cyber / CompassOne — rolling up vulnerability findings, internet-facing external exposures, dark-web credential leaks, and scan coverage into a prioritized remediation view for QBRs, security reviews, or risk reporting. Trigger for: Blackpoint exposure report, CompassOne vulnerability rollup, attack surface Blackpoint, dark web exposure Blackpoint, external exposure CompassOne, Blackpoint QBR, scan coverage Blackpoint, remediation priorities. Examples: "Build an exposure report for the Acme tenant", "What dark-web leaks are showing for our CompassOne clients?", "Roll up the vulnerability posture across all tenants for the QBR", "Which tenants have unpatched internet-facing services?"

Use this skill when working with the Blackpoint Cyber (CompassOne) MCP tools — Bearer token authentication, the partner-tenant-asset hierarchy, navigation tools, and the read-only tool surface across tenants, assets, detections, and vulnerabilities.

Use this skill when working with Blackpoint Cyber (CompassOne) asset data — listing assets by class for a tenant, searching across classes, pulling asset detail, and walking parent/child/sibling relationships to build a blast-radius or topology view.

Use this skill when investigating a Blackpoint Cyber detection — drilling from a tenant to its assets, walking the detection list, pulling vulnerability and dark-web context, and assembling an incident timeline.

Use this skill when operating Blackpoint Cyber (CompassOne) at the MSP partner level — enumerating customer tenants, sweeping detections and vulnerabilities across all of them, spotting volume anomalies, and building per-tenant scorecards.

Use this skill when analyzing Blackpoint Cyber (CompassOne) exposure data — host vulnerability findings filtered by CVE and exploitability, vulnerability scan history, dark-web credential and data leaks, and external internet-facing exposures.