From kaseya-rocketcyber
Manages RocketCyber RocketAgent: deployment, installation, online/offline status, health monitoring, troubleshooting, platform support, and connectivity diagnostics on Windows, macOS, Linux endpoints.
npx claudepluginhub wyre-technology/msp-claude-plugins --plugin rocketcyberThis skill uses the workspace's default tool permissions.
RocketAgent is the endpoint agent deployed by RocketCyber to customer workstations and servers. It provides the telemetry pipeline for threat detection -- collecting event data, monitoring processes, and reporting back to the RocketCyber SOC platform. Agent health directly impacts the MSP's security coverage.
Provides UI/UX resources: 50+ styles, color palettes, font pairings, guidelines, charts for web/mobile across React, Next.js, Vue, Svelte, Tailwind, React Native, Flutter. Aids planning, building, reviewing interfaces.
Fetches up-to-date documentation from Context7 for libraries and frameworks like React, Next.js, Prisma. Use for setup questions, API references, and code examples.
Calculates TAM/SAM/SOM using top-down, bottom-up, and value theory methodologies for market sizing, revenue estimation, and startup validation.
RocketAgent is the endpoint agent deployed by RocketCyber to customer workstations and servers. It provides the telemetry pipeline for threat detection -- collecting event data, monitoring processes, and reporting back to the RocketCyber SOC platform. Agent health directly impacts the MSP's security coverage.
Key agent functions:
┌──────────────┐ Deploy ┌────────────┐ Checks In ┌──────────┐
│ Unmanaged │ ──────────> │ Installed │ ─────────────> │ Online │
│ Endpoint │ │ (Pending) │ │ │
└──────────────┘ └────────────┘ └──────────┘
│
Communication │ Lost
▼
┌──────────┐
│ Offline │
└──────────┘
| Status | Description | Action |
|---|---|---|
| Online | Agent is communicating normally with the RocketCyber cloud | No action needed |
| Offline | Agent has not communicated within the expected interval | Investigate connectivity, service status |
RocketAgent supports multiple platforms (verify against current documentation):
| Platform | Description |
|---|---|
| Windows | Primary platform -- workstations and servers |
| macOS | Mac endpoint support |
| Linux | Server monitoring (verify availability) |
| Field | Type | Description |
|---|---|---|
id | integer | Unique agent identifier |
hostname | string | Endpoint hostname |
accountId | integer | Customer account the agent belongs to |
accountName | string | Customer account name (verify against API docs) |
platform | string | Operating system platform (Windows, macOS, Linux) |
osVersion | string | OS version details (verify against API docs) |
status | string | Communication status: Online, Offline |
lastSeen | datetime | Last successful communication timestamp |
agentVersion | string | Installed RocketAgent version (verify against API docs) |
ipAddress | string | Last known IP address (verify against API docs) |
installedAt | datetime | When the agent was first installed (verify against API docs) |
Note: Field names are inferred from the Celerium PowerShell wrapper. Verify exact field names against RocketCyber API responses.
# All agents across all accounts
curl -s "https://api-${ROCKETCYBER_REGION:-us}.rocketcyber.com/v3/agents" \
-H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"
Response (verify against API docs):
{
"data": [
{
"id": 5001,
"hostname": "WORKSTATION-01",
"accountId": 12345,
"platform": "Windows",
"status": "Online",
"lastSeen": "2026-02-23T10:15:00Z",
"agentVersion": "3.2.1"
}
],
"totalCount": 350,
"page": 1,
"limit": 50
}
# Agents for a specific customer
curl -s "https://api-us.rocketcyber.com/v3/agents?accountId=12345" \
-H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"
# Single agent with full details
curl -s "https://api-us.rocketcyber.com/v3/agents/5001" \
-H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"
Response (verify against API docs):
{
"id": 5001,
"hostname": "WORKSTATION-01",
"accountId": 12345,
"accountName": "Acme Corporation",
"platform": "Windows",
"osVersion": "Windows 11 Pro 23H2",
"status": "Online",
"lastSeen": "2026-02-23T10:15:00Z",
"agentVersion": "3.2.1",
"ipAddress": "192.168.1.50",
"installedAt": "2025-06-15T09:00:00Z"
}
When an agent shows as Offline:
Get-Service -Name "RocketAgent" | Select-Object Status, StartType
*.rocketcyber.comagentVersion| Scenario | HTTP Code | Resolution |
|---|---|---|
| Invalid API key | 401 | Verify key in Provider Settings > API |
| Agent not found | 404 | Verify agent ID; agent may have been removed |
| Account has no agents | 200 (empty) | Agents not yet deployed to this customer |
| Rate limited | 429 | Back off 30 seconds, retry |
No agents found for account ID 12345.
This could mean:
- Agents have not been deployed to this customer
- The account ID is incorrect (verify with /accounts endpoint)
- Agents were recently removed