ARMO Ctrl

Skills

14 in the Claude listing

• armoctlARMO security platform CLI — JSON-first agent-friendly access to runtime incidents, vulnerabilities, posture, risks, attack chains, inventory, network policies, seccomp, runtime rules/policies, integr
• Armoctl attack chainsAttack chains — multi-step kill-chain views built by ARMO from runtime + posture signal.
• Armoctl cloud accountsCloud account onboarding — list/connect/disconnect ECS accounts.
• Armoctl incidentsARMO runtime incidents — list active threats, fetch alerts on a single incident, explain an incident's signal, resolve/silence incidents.
• Armoctl integrationsOutbound integrations — alert channels (Slack/email/webhook), SIEM forwarders, Jira ticket creation.
• Armoctl inventoryCluster inventory — list workloads, get unique values for a field.
• Armoctl network policiesGenerated NetworkPolicies — list discovered policies and generate one for a workload from observed traffic.
• Armoctl postureKubernetes posture scanning — controls, frameworks, exceptions.
• Armoctl repo postureRepository posture — IaC scanning of a connected git repo for config issues, with per-file and per-control views.
• Armoctl risksSecurity risks (cross-cutting risk view) — list/resources/severities and exception policies.
• Armoctl runtime policiesRuntime policies — bundles of rules attached to clusters/namespaces/workloads.
• Armoctl runtime rulesRuntime detection rules — CRUD on the per-rule policy surface (the ARMO equivalent of a Falco rule).
• Armoctl seccompGenerated seccomp profiles — list and generate profiles per workload.
• Armoctl vulnsARMO vulnerability triage — list CVEs, find affected images/hosts/workloads, check runtime relevance, manage exception policies.