AI Agent Workflow Collection

Use when working with Abnormal Security threat detection and analysis - BEC, phishing, malware, socially-engineered attacks, spam, graymail, and credential theft. Covers threat types, attack vectors, severity assessment, remediation actions, and investigation workflows. Essential for MSP security analysts investigating email-borne threats detected by Abnormal Security's AI-powered behavioral engine.

Use when working with Abnormal Security VendorBase vendor risk assessment - vendor risk scores, compromised vendor detection, vendor domain analysis, and supply chain email threat monitoring. Covers vendor risk levels, risk factors, compromised vendor workflows, and vendor-related threat investigation. Essential for MSP security analysts monitoring third-party vendor risk via Abnormal Security.

Reconciling PSA contract/agreement entitlements (seats, hours, recurring services) against invoiced reality in an accounting platform, across any combination of PSA (Autotask, HaloPSA, ConnectWise, Syncro) and accounting platform (QuickBooks Online, Xero). Covers building the entitlement ledger, the cross-system matching priority, and the gap classes — under-billing, over-billing, lapsed agreements still invoiced, active agreements never billed, and price drift.

A common Critical/High/Medium/Low normalized severity model for security alerts, incidents, and findings, with the judgment axes (confidence, mitigation state, blast radius) that place a record in a tier and the mapping from each vendor's native terminology — Huntress incident status, SentinelOne threat confidence, Blumira finding priority, CIPP alert queue severity, Blackpoint Cyber SOC severity, SaaS Alerts risk level — plus how to discover which security vendors are actually connected.

Use when working with Alternative Payments customers and their users - listing, retrieving, and creating customers, adding users to a customer, and archiving customers. Covers customer fields, the customer/user relationship, MSP client onboarding, and the destructive archive operation that requires confirmation.

Use when working with Atera tickets - creating, updating, searching, or managing service desk operations. Covers ticket fields, statuses, priorities, comments, work hours, and billing duration. Essential for MSP technicians handling service delivery through Atera.

Use when working with Autotask Configuration Items (CIs) - asset management, inventory tracking, warranty monitoring, lifecycle management, and relationship mapping. Covers CI types, categories, DNS records, SSL certificates, related items, notes, and contract billing associations. Essential for MSP asset documentation and infrastructure tracking.

Use when working with Autotask CRM - companies, contacts, sites/locations, and opportunities. Essential for MSP account management, client onboarding, and relationship tracking in Autotask PSA.

Use when working with Autotask expense reports and expense items - creating expense reports, adding line items, searching reports by status or submitter, tracking reimbursable vs billable expenses, and managing expense approval workflows. Covers expense categories, payment types, receipt tracking, and company billing for MSP operational expenses.

Use when working with Autotask Service Calls - creating, scheduling, updating, or completing service calls linked to tickets. Covers service call fields, status codes, linking tickets to service calls, and managing technician (resource) assignments on service call tickets. Essential for MSP technicians scheduling on-site visits and planned work.

Use when working with Autotask time entries - logging work hours, billing calculations, approval workflows, utilization tracking, and budget validation. Covers time entry fields, billing rates, approval statuses, contract limits, and integration with tickets and projects. Essential for MSP technicians tracking billable and non-billable work.

Use when working with Auvik network and interface entities - the network entity model, IP-range scoping, interface-to-device relationships, and admin vs oper status.

Use when connecting the azure-mcp vendor through the WYRE MCP Gateway — registering an Azure service principal, supplying tenantId/clientId/clientSecret, and granting least-privilege Reader-tier RBAC. Covers the read-only deployment model and why broader write roles must not be granted.

Use this skill for Azure cost, pricing, capacity, and inventory work through the azure-mcp connector — retail pricing lookups, subscription quota and usage-limit checks, and listing/inspecting subscriptions and resource groups. All read-only.

Portfolio-wide backup job health across whatever BCDR and SaaS-backup tools are connected: the two structurally different job models (image-based appliance backup vs. SaaS-data snapshot backup) and how to normalize them into one health record per protected unit, why a live consecutive-failure streak matters more than a trailing success rate, the missed-versus-failed distinction and its different root causes, and the two storage-trending risk patterns (approaching capacity, anomalous growth).

Business Email Compromise detection and first response: the signals that reveal it in CIPP/M365 audit logs, mailbox and forwarding rules, and connected email security vendor alerts; the order-dependent response sequence (session revocation, forwarding-rule audit, mailbox rule and delegate cleanup, password reset, MFA re-enrollment, lateral-spread check, recipient notification); and what a defensible incident timeline must capture for insurance or bank-fraud claims.

Use when working with Better Stack incidents -- listing, triaging, acknowledging, and resolving incidents triggered by uptime monitors or manual reports.

Use when working with Better Stack status pages -- managing status pages, adding resources/components, posting maintenance windows, and communicating service status to end users.

Use when working with Blackpoint Cyber (CompassOne) asset data — listing assets by class for a tenant, searching across classes, pulling asset detail, and walking parent/child/sibling relationships to build a blast-radius or topology view.

Use when operating Blackpoint Cyber (CompassOne) at the MSP partner level — enumerating customer tenants, sweeping detections and vulnerabilities across all of them, spotting volume anomalies, and building per-tenant scorecards.

Use when analyzing Blackpoint Cyber (CompassOne) exposure data — host vulnerability findings filtered by CVE and exploitability, vulnerability scan history, dark-web credential and data leaks, and external internet-facing exposures.

Use when working with Blumira findings (security alerts/detections), including listing, filtering, investigating, resolving, assigning, and commenting on findings.

Use when working with Blumira MSP (Managed Service Provider) multi-tenant operations, including managing multiple client accounts, cross-account finding queries, and per-account device/user management.

Use when resolving Blumira findings, choosing the correct resolution type, or understanding resolution workflows and their impact on security metrics.