Claroty Risk Triage
Unified alert + vulnerability triage for OT / IoT / IoMT environments via Claroty xDome. Alerts and vulnerabilities are bundled into one skill because real incident response crosses the boundary constantly — operators investigate an alert, pivot to the affected device's CVE list, and back to the alert label.
When to Use
- Triaging Claroty xDome alerts by severity, site, or assignee
- Computing the blast radius of an alert (which devices, which protocols)
- Inspecting vulnerability findings, filtering by CVSS, and listing affected devices
- Marking a CVE as not-relevant for a specific device (mitigation in place, compensating control, patched out-of-band)
- Acknowledging, labelling, or assigning alerts during a hunt
- Handing off to
ise-incident-response for endpoint quarantine or to servicenow-change-workflow for a remediation CR
MCP Server
- Server:
claroty-mcp
- Command:
python3 -u mcp-servers/claroty-mcp/claroty_mcp_server.py (stdio transport)
- Auth: Bearer token via
CLAROTY_API_TOKEN
- ITSM: Write operations require a
CHG\d+ CR; bypassed in NETCLAW_LAB_MODE=true
Available Tools
| Tool |
Parameters |
What It Does |
list_alerts |
severity?, status?, site_id?, assignee?, limit?, offset?, max_items? |
List security alerts with filters |
get_alert_with_devices |
alert_id, device_limit? |
Alert + affected devices in one call |
list_vulnerabilities |
severity?, cvss_min?, cve_contains?, limit?, offset?, max_items? |
List CVE-aligned findings |
get_vulnerable_devices |
vulnerability_id, limit?, offset? |
Devices affected by one CVE (blast radius) |
acknowledge_alert |
alert_id, resolution, cr_number, note? |
Write (ITSM-gated) — set resolution state |
set_vulnerability_relevance |
device_id, vulnerability_id, relevant, cr_number, note? |
Write (ITSM-gated) — suppress / re-enable CVE on a device |
label_alerts |
alert_ids, labels, cr_number, replace? |
Write (ITSM-gated) — apply / replace labels |
assign_alerts |
alert_ids, assignee, cr_number, note? |
Write (ITSM-gated) — assign alerts to a user / queue |
Compose with:
nvd_get_cve from the nvd-cve skill for full CVSS vector decompositionise-incident-response skill for endpoint quarantineservicenow-change-workflow skill to open a remediation CR if the alert demands a config change
Workflow Examples
Triage all high-severity open alerts
"List all open high-severity alerts at site warehouse-east"
Calls list_alerts(severity="high", status="open", site_id="warehouse-east"). Returns severity-sorted alert table.
Blast-radius investigation
"Show me alert a1b2c3 and every device it touches"
Calls get_alert_with_devices(alert_id="a1b2c3") and renders the alert metadata plus affected devices. From there, pivot to list_vulnerabilities filtered by site to understand combined risk.
CVE blast radius across the fleet
"What devices are vulnerable to CVE-2024-12345? Correlate with NVD for full context."
list_vulnerabilities(cve_contains="2024-12345") → xDome finding ID.get_vulnerable_devices(vulnerability_id="<id>") → affected device list.nvd_get_cve(cve_id="CVE-2024-12345") (nvd-cve skill) → CVSS vector, references, fix availability.- Optionally
list_devices with cross-reference to Nautobot to confirm criticality.
Suppress a known false positive
"Mark CVE-2024-12345 as not-relevant for device 7a2c (mitigated by network ACL) under CHG0013001"
Calls set_vulnerability_relevance(device_id="7a2c...", vulnerability_id="<id>", relevant=False, cr_number="CHG0013001", note="mitigated by network ACL").
Label and assign an alert during a hunt
"Label alerts [a1, a2, a3] as 'ransomware-candidate' and assign to alice under CHG0013002"
label_alerts(alert_ids=[...], labels=["ransomware-candidate"], cr_number="CHG0013002").assign_alerts(alert_ids=[...], assignee="alice", cr_number="CHG0013002").
Acknowledge after remediation
"Acknowledge alert a1b2c3 as resolved with a note pointing at CHG0013001's evidence"
Calls acknowledge_alert(alert_id="a1b2c3", resolution="resolved", cr_number="CHG0013001", note="...").
ITSM gating
Identical to other Claroty write tools: CHG\d+ format, ServiceNow "Implement" state check (skipped in lab mode). Rejected gate returns {"itsm_gate": {...}, "applied": false} and the xDome write is not made.
ISE handoff pattern
If a Claroty alert resolves to "compromised endpoint", do NOT call ISE quarantine from inside this skill. Hand off to ise-incident-response per Principle XIV (human-in-the-loop for external actions). That skill enforces the human decision point before any quarantine action.
Token scope expectations
If a write tool returns applied: false and an error object with status_code: 403, the ITSM gate passed and the body was correctly built — xDome rejected at RBAC. The token in CLAROTY_API_TOKEN lacks write scope on the relevant resource (alerts for acknowledge_alert/label_alerts/assign_alerts; vulnerabilities for set_vulnerability_relevance). Don't retry — escalate to whoever provisions xDome API tokens. The wrapper surfaces xDome's response body verbatim so you can see exactly which scope is missing.
1---2name: claroty-risk-triage3description: Triage Claroty xDome alerts and vulnerabilities, compute blast radius, correlate with NVD CVE data, and drive ITSM-gated workflow actions (acknowledge, label, assign, set relevance).4license: Apache-2.05---6
7# Claroty Risk Triage
8
9Unified alert + vulnerability triage for OT / IoT / IoMT environments via Claroty xDome. Alerts and vulnerabilities are bundled into one skill because real incident response crosses the boundary constantly — operators investigate an alert, pivot to the affected device's CVE list, and back to the alert label.
10
11## When to Use
12
13- Triaging Claroty xDome alerts by severity, site, or assignee
14- Computing the blast radius of an alert (which devices, which protocols)
15- Inspecting vulnerability findings, filtering by CVSS, and listing affected devices
16- Marking a CVE as not-relevant for a specific device (mitigation in place, compensating control, patched out-of-band)
17- Acknowledging, labelling, or assigning alerts during a hunt
18- Handing off to `ise-incident-response` for endpoint quarantine or to `servicenow-change-workflow` for a remediation CR
19
20## MCP Server
21
22- **Server**: `claroty-mcp`
23- **Command**: `python3 -u mcp-servers/claroty-mcp/claroty_mcp_server.py` (stdio transport)
24- **Auth**: Bearer token via `CLAROTY_API_TOKEN`
25- **ITSM**: Write operations require a `CHG\d+` CR; bypassed in `NETCLAW_LAB_MODE=true`
26
27## Available Tools
28
29| Tool | Parameters | What It Does |
30|------|------------|--------------|
31| `list_alerts` | `severity?, status?, site_id?, assignee?, limit?, offset?, max_items?` | List security alerts with filters |
32| `get_alert_with_devices` | `alert_id, device_limit?` | Alert + affected devices in one call |
33| `list_vulnerabilities` | `severity?, cvss_min?, cve_contains?, limit?, offset?, max_items?` | List CVE-aligned findings |
34| `get_vulnerable_devices` | `vulnerability_id, limit?, offset?` | Devices affected by one CVE (blast radius) |
35| `acknowledge_alert` | `alert_id, resolution, cr_number, note?` | **Write (ITSM-gated)** — set resolution state |
36| `set_vulnerability_relevance` | `device_id, vulnerability_id, relevant, cr_number, note?` | **Write (ITSM-gated)** — suppress / re-enable CVE on a device |
37| `label_alerts` | `alert_ids, labels, cr_number, replace?` | **Write (ITSM-gated)** — apply / replace labels |
38| `assign_alerts` | `alert_ids, assignee, cr_number, note?` | **Write (ITSM-gated)** — assign alerts to a user / queue |
39
40Compose with:
41
42- `nvd_get_cve` from the **nvd-cve** skill for full CVSS vector decomposition
43- `ise-incident-response` skill for endpoint quarantine
44- `servicenow-change-workflow` skill to open a remediation CR if the alert demands a config change
45
46## Workflow Examples
47
48### Triage all high-severity open alerts
49
50```
51"List all open high-severity alerts at site warehouse-east"
52```
53
54Calls `list_alerts(severity="high", status="open", site_id="warehouse-east")`. Returns severity-sorted alert table.
55
56### Blast-radius investigation
57
58```
59"Show me alert a1b2c3 and every device it touches"
60```
61
62Calls `get_alert_with_devices(alert_id="a1b2c3")` and renders the alert metadata plus affected devices. From there, pivot to `list_vulnerabilities` filtered by site to understand combined risk.
63
64### CVE blast radius across the fleet
65
66```
67"What devices are vulnerable to CVE-2024-12345? Correlate with NVD for full context."
68```
69
701. `list_vulnerabilities(cve_contains="2024-12345")` → xDome finding ID.
712. `get_vulnerable_devices(vulnerability_id="<id>")` → affected device list.
723. `nvd_get_cve(cve_id="CVE-2024-12345")` (nvd-cve skill) → CVSS vector, references, fix availability.
734. Optionally `list_devices` with cross-reference to Nautobot to confirm criticality.
74
75### Suppress a known false positive
76
77```
78"Mark CVE-2024-12345 as not-relevant for device 7a2c (mitigated by network ACL) under CHG0013001"
79```
80
81Calls `set_vulnerability_relevance(device_id="7a2c...", vulnerability_id="<id>", relevant=False, cr_number="CHG0013001", note="mitigated by network ACL")`.
82
83### Label and assign an alert during a hunt
84
85```
86"Label alerts [a1, a2, a3] as 'ransomware-candidate' and assign to alice under CHG0013002"
87```
88
891. `label_alerts(alert_ids=[...], labels=["ransomware-candidate"], cr_number="CHG0013002")`.
902. `assign_alerts(alert_ids=[...], assignee="alice", cr_number="CHG0013002")`.
91
92### Acknowledge after remediation
93
94```
95"Acknowledge alert a1b2c3 as resolved with a note pointing at CHG0013001's evidence"
96```
97
98Calls `acknowledge_alert(alert_id="a1b2c3", resolution="resolved", cr_number="CHG0013001", note="...")`.
99
100## ITSM gating
101
102Identical to other Claroty write tools: `CHG\d+` format, ServiceNow "Implement" state check (skipped in lab mode). Rejected gate returns `{"itsm_gate": {...}, "applied": false}` and the xDome write is not made.
103
104## ISE handoff pattern
105
106If a Claroty alert resolves to "compromised endpoint", do **NOT** call ISE quarantine from inside this skill. Hand off to `ise-incident-response` per Principle XIV (human-in-the-loop for external actions). That skill enforces the human decision point before any quarantine action.
107
108## Token scope expectations
109
110If a write tool returns `applied: false` and an `error` object with `status_code: 403`, the ITSM gate passed and the body was correctly built — xDome rejected at RBAC. The token in `CLAROTY_API_TOKEN` lacks write scope on the relevant resource (alerts for `acknowledge_alert`/`label_alerts`/`assign_alerts`; vulnerabilities for `set_vulnerability_relevance`). Don't retry — escalate to whoever provisions xDome API tokens. The wrapper surfaces xDome's response body verbatim so you can see exactly which scope is missing.
gabrielmoreira