Security Operations

Run the exposure ranking for one client or the whole portfolio — open critical findings, unmitigated threats, MFA gaps, and stale EDR coverage

Build a client-facing incident summary for a given client and time window, assembling a chronological timeline across every connected security, PSA, and documentation tool

Sweep every connected security tool across all clients/tenants, normalize findings, and report the top most urgent items portfolio-wide

Use this agent when a security incident needs to be reconstructed into a single chronological timeline suitable for a client-facing incident report, pulling every relevant event across every connected security, PSA, and documentation tool for the client and time window in question. Trigger for: incident timeline, build incident report, what happened during this incident, incident reconstruction, reconstruct the incident, timeline of events, client incident report. Examples: "Build an incident timeline for Acme Corp's compromised account from yesterday", "What happened during incident INC-4821 — give me the full timeline", "I need a client-facing report on last week's malware incident"

Use this agent when a technician needs a morning read on everything that fired overnight across the connected EDR/MDR/SIEM stack, normalized into one ranked digest instead of five separate vendor consoles. Trigger for: overnight alerts, morning security review, what happened overnight, alert summary, overnight digest, security morning check, what fired last night. Examples: "Summarize what happened overnight", "Give me the morning security review", "What alerts came in while we were closed?"

Use this agent when the MSP needs a portfolio-wide read on which clients carry the most current security risk — open critical findings, unpatched or uncontained threats, MFA coverage gaps, and stale EDR/agent coverage — ranked so leadership or the security team can prioritize attention. Trigger for: tenant risk ranking, which clients are most exposed, portfolio risk review, exposure sweep, risk ranking, most at-risk clients, which client needs attention. Examples: "Which clients are most exposed right now?", "Run a portfolio risk review", "Rank our clients by security exposure"

Use this skill when triaging security alerts, incidents, or findings that come from more than one connected EDR/MDR/SIEM vendor and a single, comparable severity ranking is needed. Covers a common Critical/High/Medium/Low normalized model, how to map each vendor's native severity terminology (Huntress incident status, SentinelOne threat confidence, Blumira finding priority, CIPP alert queue severity, Blackpoint Cyber SOC severity, SaaS Alerts risk level, and others) into it, and how to discover which vendors are actually connected before assuming any one of them is present.

Use this skill when Business Email Compromise (BEC) is suspected or confirmed for a client. Covers how to detect the signs from CIPP/M365 audit logs and connected email security vendor alerts, the immediate response sequence (session revocation, forwarding-rule audit, mailbox rule cleanup, password reset, MFA re-enrollment), and how to document the incident timeline for a client-facing report.

Use this skill when a security incident has been confirmed or is highly suspected and immediate first-response containment steps are needed. Covers standard containment sequences for the most common MSP incident classes — compromised account, malware/ransomware detection, business email compromise, and exposed credential — including what to do first, the correct order of operations, and which connected tool family (RMM, EDR, CIPP/Entra, PSA) handles each step.