How does this skill help with incident triage?

It provides structured patterns to filter incidents by severity, allowing analysts to focus on Critical and High threats first while providing the necessary API commands to retrieve full investigation details.

How do verdicts work in this skill?

The skill guides the user through assigning standardized verdicts—Malicious, Suspicious, or Benign—based on the evidence found during the investigation.

Can I use this to update incident status?

Yes, the skill includes the logic and API patterns required to transition incidents between New, In Progress, Resolved, and False Positive states.

Does it support multiple customer accounts?

Absolutely. You can filter incidents by specific account IDs to scope your investigation to a single client or view threats across your entire MSP portfolio.

RocketCyber Incident Management

Name: RocketCyber Incident Management
Author: wyre-technology

bywyre-technology

•

Security & Testing

Manages and triages RocketCyber security incidents by streamlining threat investigation, verdict assignment, and resolution workflows.

This skill empowers Claude to interact with the RocketCyber managed SOC platform to handle security incidents throughout their entire lifecycle. It provides specialized guidance for searching incidents, analyzing threat telemetry, assigning verdicts like Malicious or Benign, and correlating findings with PSA tickets. By automating the retrieval and filtering of incidents by severity or status, it helps MSP technicians and SOC analysts prioritize critical threats and maintain a robust security posture for their customers.

Key Features

01Guidance for assigning Malicious, Suspicious, and Benign verdicts

02Automated incident retrieval and filtering by severity, status, or account

03Standardized SOC triage patterns for efficient threat investigation

04API interaction patterns for incident lifecycle management and updates

053 GitHub stars

06Cross-vendor PSA ticket correlation for streamlined billing and tracking

Use Cases

01Generating customer security reports by aggregating incident data across specific accounts

02Prioritizing and triaging high-severity security threats during daily SOC reviews

03Investigating PowerShell execution or behavioral anomalies detected by endpoint telemetry

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add wyre-technology/msp-claude-plugins incidents

For use in Claude.ai and ChatGPT

Download Skill