secops-pack

Plugin secops-pack from marketplace msp-claude-plugins in WYRE-AI/msp-claude-plugins. Commands read from the repo's manifest — yesterday.

Skills (6)

• Alert Severity Normalization

  A common Critical/High/Medium/Low normalized severity model for security alerts, incidents, and findings, with the judgment axes (confidence, mitigation state, blast radius) that place a record in a tier and the mapping from each vendor's native terminology — Huntress incident status, SentinelOne th

• BEC Response

  Business Email Compromise detection and first response: the signals that reveal it in CIPP/M365 audit logs, mailbox and forwarding rules, and connected email security vendor alerts; the order-dependent response sequence (session revocation, forwarding-rule audit, mailbox rule and delegate cleanup, p

• Containment Playbooks

  Ordered first-response containment sequences for the most common MSP incident classes — compromised account, malware/ransomware detection, business email compromise, and exposed credential — including why the order matters, which connected tool family (RMM, EDR, CIPP/Entra, PSA, documentation) handl

• MSP Tool Compromise Response

  Cross-tool investigation of a suspected or vendor-disclosed compromise of an MSP management-plane platform (RMM, remote access, or similar automation). Correlates independent EDR, identity, network, cloud, and documentation evidence with scoped management-plane reads, produces a per-client findings

• ScreenConnect Session Hijack Response

  Read-only investigation of legitimate ScreenConnect panel abuse, rogue remote-access clients, and a reported GUI-session reverse pivot onto technician workstations. Correlates per-client endpoint, identity, network, and manually exported panel evidence; produces per-tech blast radius, an approval-ga

• Shadow AI

  Per-client comparison of observed RMM installed software with Microsoft 365 / Entra application and service principal inventory, conservative AI product matching, unsanctioned-tool findings, optional consent-risk review, and explicit source-coverage limitations. When an MSP wants to identify unappro

Slash commands (3)

• /secops-pack:incident-report

  Build a client-facing incident summary for a given client and time window, assembling a chronological timeline across every connected security, PSA, and documentation tool

• /secops-pack:portfolio-sweep

  Sweep every connected security tool across all clients/tenants, normalize findings, and report the top most urgent items portfolio-wide

• /secops-pack:tenant-exposure

  Run the exposure ranking for one client or the whole portfolio — open critical findings, unmitigated threats, MFA gaps, and stale EDR coverage

Subagents (3)

• incident-timeline-builder

  Use this agent when a security incident needs to be reconstructed into a single chronological timeline suitable for a client-facing incident report, pulling every relevant event across every connected security, PSA, and documentation tool for the client and time window in question. Trigger for: inci

• overnight-alert-summarizer

  Use this agent when a technician needs a morning read on everything that fired overnight across the connected EDR/MDR/SIEM stack, normalized into one ranked digest instead of five separate vendor consoles. Trigger for: overnight alerts, morning security review, what happened overnight, alert summary

• tenant-exposure-ranker

  Use this agent when the MSP needs a portfolio-wide read on which clients carry the most current security risk — open critical findings, unpatched or uncontained threats, MFA coverage gaps, and stale EDR/agent coverage — ranked so leadership or the security team can prioritize attention. Trigger for:

MCP servers (1)

• conduit

  connects to: https://conduit.wyre.ai/v1/mcp

Similar plugins