The All-in-One AI Plugin for Security Engineers

Skills for security engineers 17

• security threat identifierAssesses threats across logs, malware, traffic, and architecture, for example modeling an attacker path to your public API.
• security assessment plannerBuilds plans and checklists for scans, pen tests, risk assessments, and audits, such as scoping next quarter's penetration test.
• office security monitoringAutomates monitoring, detection, response, and compliance workflows, like a daily alert triage routine for your SOC.
• security engineerHardens infrastructure and automates security controls in CI/CD, for example adding secret scanning to every pull request.
• incident response analyst playbookGuides classification, escalation, containment, and root cause, such as a ransomware containment checklist for your response team.
• cybersecurity policy and risk assistantTurns scan reports and audit findings into risk registers and policy drafts, like a reviewed access control policy.

Plus a start-here assistant, the prompt library and the app builder, and for members the daily brief.

Ready-made prompts 24

• Triage Vulnerability Findings3 prompts, like Explain a CVE in Plain Terms
• Write Detection Rules and Queries3 prompts, like Draft a SIEM Detection Query
• Configure Security Tools3 prompts, like Explain Security Tool Configuration Options
• Investigate and Respond to Incidents3 prompts, like Draft an Incident Timeline
• Penetration Test Planning and Reporting3 prompts, like Draft a Penetration Test Plan
• Access Control and Identity3 prompts, like Design a Role-Based Access Matrix
• Policies, Frameworks, and Audits3 prompts, like Draft Security Policy Documentation

Apps you can build with AI 6

• Evidence-backed application vulnerability validation workbenchValidate application findings with evidence before they reach developers, cutting false positives and manual triage. Demo included.
• Source-linked code review and security consoleCatch security issues before merge with review tied to source lines, keeping the reviewer in control. Demo included.
• Multi-framework compliance evidence and certification workspaceCollect audit evidence once and map it to several frameworks, so certification prep stops restarting every year. Demo included.
• Permission test scenario studioTurn permission rules into allowed and denied test cases, so access control changes are proven, not assumed. Demo included.
• Source-linked AI use governance consoleReview everyday AI use with a defensible record, so staff get clear answers without shadow tools spreading. Demo included.
• Agent tool-call authorization and audit gatewayLimit standing access for AI agents and keep a reviewable record of every tool call they make. Demo included.

AI agents 12

In the download. An agent runs a whole recurring task for you, step by step, and asks you before anything important. Ask your AI: "Run the Endpoint Compliance Drift Agent". Each one also has a guided set-up with sample data on its page.

• Endpoint Compliance Drift AgentDevices back in compliance, with stragglers identified and escalated
• Log Anomaly Investigation AgentUnexplained log anomalies turned into evidence-backed draft incidents, and explained ones closed
• Shared Drive Permission Cleanup AgentShared folders with access that matches what owners confirm, and no one locked out
• IoT Device Onboarding and Segmentation AgentEvery new IoT device identified, inventoried and confined to only the access it needs
• Cloud Security Group Review AgentCloud network rules limited to what is needed, with each change tested
• Social Account Access Audit AgentKeep access to brand accounts limited to current people and tools, and verify every removal.
• Sales Cybersecurity and Data Handling Check AgentOnly the right people have access to sales tools and customer data
• IT Policy Annual Review AgentEach policy reviewed against real configurations and frameworks, with a clean draft ready for sign-off
• Stale Account Cleanup AgentA clean directory with every active account owned and needed
• Vulnerability Remediation Tracking AgentEvery important vulnerability fixed within policy deadlines and verified by rescan
• Threat Intelligence Relevance Brief AgentA short weekly brief of threats that actually apply to your environment, with checks done
• Third-Party Security Review AgentA documented risk rating for each new vendor based on checked evidence

Connections (MCP servers) 12

A guide in the download. A connection lets your AI work in an app you already use. You add only the ones you use: ask your AI "Which apps can you connect to?" and follow the steps on each connection's page.

• Panther MCP serverAsk your AI to search Panther security logs, check alerts, and review detections in plain English. Official.
• Shodan MCP serverLets your AI look up IP addresses, devices, DNS records and known security flaws using Shodan.
• VirusTotal MCP serverLets your AI check links, files, IP addresses and domains for signs of malware or scams.
• Wireshark MCP serverAsk your AI to read a network capture file and explain what happened inside it.
• Wazuh MCP serverAsk your AI about your Wazuh security alerts, agents, and vulnerabilities in plain language.
• RSigma MCP serverLet your AI help write, check and test Sigma security detection rules. Official.
• WRG Sigma Rules MCP serverDraft, check and convert Sigma detection rules into Splunk, Elastic, Kibana or Wazuh queries from your chat.
• VMware NSX Security MCP serverLet your AI manage NSX firewall rules, security groups, tags, and trace packets for you.
• Cortex MCP serverLets your AI check suspicious IPs, links, and files using your Cortex security tool.
• ZoomEye MCP serverLets your AI look up internet-connected devices and websites using ZoomEye search.
• IPinfo MCP serverLook up where an IP address is, who runs it, and whether it looks like a VPN or proxy.
• NIST Vulnerability Database MCP serverLets your AI look up known software security flaws from the official NIST database.

Your Grok Bot team 12

• Security AuditorConducts systematic security audits, compliance assessments, and risk evaluations across systems and processes.
• Penetration TesterConduct authorized penetration tests to identify and validate exploitable vulnerabilities.
• Incident ResponderAssess severity, stabilize systems, coordinate communication, and produce blameless post-incident reports.
• Security ComplianceGuides security professionals through compliance, threat modeling, and risk assessments.
• Scanning ToolsGuide users through security scanning with Nmap, Nessus, Burp Suite, Aircrack-ng, and Prowler.
• Network Security Protocol AdvisorExplains, configures, and troubleshoots network security protocols for engineers.
• Api Security AuditAudits REST APIs for security vulnerabilities and compliance gaps.
• Threat Modeling ExpertAnalyze system architecture to identify threats and recommend mitigations.
• Web Security TestingGuide structured OWASP Top 10 web application security assessments step by step.
• Senior SecurityRuns threat modeling, security audits, and penetration tests on your projects.
• Security And HardeningHardens code against vulnerabilities by threat modeling and applying OWASP prevention patterns.
• Security EngineerHardens infrastructure, automates security in CI/CD, and manages compliance and vulnerabilities.