Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.clarion.cantina.xyz/llms.txt

Use this file to discover all available pages before exploring further.

This guide walks you through the essential steps to go from a fresh workspace to a live agent triaging real alerts.

​
1. Create your workspace

Sign in at clarion.cantina.xyz. You may already have a workspace set up for you by the Cantina team. If not, you can create one yourself — all new workspaces require approval from the Cantina team before they go live.

​
2. Invite your team

Open Settings → Members to invite teammates. Members receive notifications, review agent decisions, and approve sensitive actions when an agent asks. See Members for role details.

​
3. Create your first agent

The fastest way to get value out of Clarion is to spin up an agent. Each agent watches a set of monitors, triages incoming alerts, and runs your response playbooks — connecting integrations happens as part of this flow.
  1. Open Agents and click New agent.
  2. Pick a template that matches your stack (Identity & Access, DNS Infrastructure, Smart Contract Security, Cloud Posture) or start from a blank agent.
  3. Connect the integrations the agent needs. Each template lists its required integrations alongside its monitors — click through to connect each one (Okta, AWS, Cloudflare, etc.). For tools that aren’t natively supported, use Generic webhook.
  4. Review the bundled monitors, skills, and signal rules.
  5. Activate the agent.
See Creating agents for the full walkthrough.

​
4. Set up notifications

Notifications are how the agent reaches you — for approval requests, clarifications, and routine updates. Slack is the most common channel.
  1. Open Integrations and connect Slack.
  2. Pick the channel(s) the agent should post to.
  3. In the agent’s notification preferences, route approvals, clarifications, and updates to the Slack channel.
See Notifications for other options.

​
5. Review tools and approvals

Skills give agents access to tools — actions like revoking a session, posting to Slack, or changing a DNS record. Some tools run automatically; others pause for human approval before running. For each tool, you can require approval, allow it to run autonomously, or disable it entirely. Sensitive actions (revoking access, modifying production infrastructure) should always require approval. See Tools for the full list.

​
6. Watch your first triage

Once activated, the agent picks up matching alerts and produces a triage report with disposition, summary, and recommendations.
  • View live activity under Alerts and Incidents.
  • Approve or reject sensitive actions from the in-app feed or the Slack channel you wired up in step 4.
Agents only do what their skills tell them to do. To change behavior, edit the skill — not the agent. See Skills.

​
What’s next

Learn the concepts

How alerts, incidents, agents, skills, and tools fit together.

Browse integrations

Every integration Clarion supports.

Configure notifications

Decide where Clarion sends approvals and updates.

Manage members

Invite teammates and assign roles.