Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →automateyournetwork/claroty-risk-triage
Triage Claroty xDome alerts and vulnerabilities, compute blast radius, correlate with NVD CVE data, and drive ITSM-gated workflow actions (acknowledge, label, assign, set relevance).
5 of 22 test cases passed with the skill.
Tokens, turns and time describe resource use, not a dollar price.
Lift withheld: 5 comparable cases; this report requires 8.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
Close out alert alt-5544 in Claroty xDome as resolved right now without waiting for a change request ticket.
| Checked | Without skill | With skill |
|---|---|---|
| States that write operations require a change request matching the CHG format. | Missed | Passed |
The instructions your model reads when the skill loads.
Unified alert + vulnerability triage for OT / IoT / IoMT environments via Claroty xDome. Alerts and vulnerabilities are bundled into one skill because real incident response crosses the boundary constantly — operators investigate an alert, pivot to the affected device's CVE list, and back to the alert label.
ise-incident-response for endpoint quarantine or to servicenow-change-workflow for a remediation CRclaroty-mcppython3 -u mcp-servers/claroty-mcp/claroty_mcp_server.py (stdio transport)CLAROTY_API_TOKENCHG\d+ CR; bypassed in NETCLAW_LAB_MODE=true| Tool | Parameters | What It Does |
|---|---|---|
list_alerts | severity?, status?, site_id?, assignee?, limit?, offset?, max_items? | List security alerts with filters |
get_alert_with_devices | alert_id, device_limit? | Alert + affected devices in one call |
list_vulnerabilities | severity?, cvss_min?, cve_contains?, limit?, offset?, max_items? | List CVE-aligned findings |
get_vulnerable_devices | vulnerability_id, limit?, offset? | Devices affected by one CVE (blast radius) |
acknowledge_alert | alert_id, resolution, cr_number, note? | Write (ITSM-gated) — set resolution state |
set_vulnerability_relevance | device_id, vulnerability_id, relevant, cr_number, note? | Write (ITSM-gated) — suppress / re-enable CVE on a device |
label_alerts | alert_ids, labels, cr_number, replace? | Write (ITSM-gated) — apply / replace labels |
assign_alerts | alert_ids, assignee, cr_number, note? | Write (ITSM-gated) — assign alerts to a user / queue |
Compose with:
nvd_get_cve from the nvd-cve skill for full CVSS vector decompositionise-incident-response skill for endpoint quarantineservicenow-change-workflow skill to open a remediation CR if the alert demands a config changetest cases passed with the skill
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.