Our agents

Clarion ships 33 agent templates. Each one bundles the monitors it listens to, the skills that tell it how to respond, and — for the scheduled ones — a recurring job. Create an agent from a template and it arrives configured; fork any skill afterwards to make it yours.

Templates come in two shapes:

Monitor-driven — the agent wakes up when a connected integration sends an event, and triages the issue that event produces.
Scheduled — the agent has no monitors. It runs a recurring sweep against your connected tools and files issues from what it finds. Deactivating the agent pauses the sweep.

Cloud & platform

Agent	Coverage	Signal source	Skills
Cloud Security (AWS)	IAM privilege escalation, root-account use, credential exposure, compute compromise, data exfiltration, log tampering	CloudTrail, GuardDuty	10
Amazon Inspector	Package CVE, code vulnerability, and network-reachability triage with AWS asset blast-radius estimation	Amazon Inspector	2
Cloud Security (Azure)	Defender for Cloud alerts, Entra ID and RBAC privilege abuse, Storage and Key Vault exposure, network and compute compromise, Secure Score remediation	Defender for Cloud	10
Cloud Security (GCP)	Audit-log privilege abuse, service-account key compromise, unauthorized compute, Security Command Center findings	Cloud Logging, Security Command Center, Cloud Monitoring	7
Wiz	CNAPP issues routed by type — toxic combinations, threat detections, entitlement findings, vulnerability exposure	Wiz Issues	5
Cloudflare Notifications	DDoS and WAF attacks, origin and edge availability, DNS and zone integrity, certificate lifecycle, client-side security	Cloudflare Notifications	5
Cloudflare Logpush	L7 DDoS detection windows, origin exposure and DNS bypass checks, incident handoff	Cloudflare Logpush (`firewall_events`)	3
Vercel Platform	Deployment failures, runtime errors, firewall attacks, domain health, production rollback	Vercel	3
Infrastructure & Ops	Uptime and outage runbooks, host threats, suspicious SSH activity	Grafana, Better Stack, Falco	1

Identity & access

Agent	Coverage	Signal source	Skills
Identity & Access	Impossible travel, brute force, MFA attacks and session hijacking, OAuth and app abuse, admin compromise, federation abuse, policy weakening, phishing response	Okta, Google Workspace, JumpCloud	14
1Password	Burst failed sign-ins, user suspension, vault item exports and the grant-then-export sequence	1Password Events Reporting	4

Endpoint & detection

Agent	Coverage	Signal source	Skills
Microsoft Sentinel & Defender XDR	Incident triage and KQL hunting, plus scenario playbooks for identity compromise, phishing, endpoint forensics, ransomware scoping, Azure control-plane attacks, UEBA anomalies	Microsoft Sentinel	8
Endpoint Monitoring	Script and LOLBin execution, persistence, credential access, sensor tampering, lateral movement, C2 and exfiltration, ransomware	CrowdStrike Falcon	9
Microsoft Defender XDR	Correlated incident hydration with Entra pivots, routed to identity scenario playbooks	Microsoft Defender XDR	5
SentinelOne	Threat triage, investigation and scoping, gated containment, false-positive handling and exclusions	SentinelOne Singularity	4
Huntress	Verifies the Huntress SOC’s report, reconstructs the attack chain, then hands containment to your EDR or identity path — Huntress is read-only in Clarion	Huntress Managed EDR/MDR, ITDR	3

DNS & external exposure

Agent	Coverage	Signal source	Skills
DNS & Domain Security	Record and subdomain changes, email-auth (SPF/DKIM/DMARC) changes, new subdomain discovery, registrar hijack, DNS tunneling, DDoS amplification	DNS monitor	7
Exposure Agent	Sweeps every connected provider for deployments reachable from the public internet that were not meant to be, and remembers verdicts so known-public sites stop re-reporting	Scheduled — daily	4
Dangling Subdomain Agent	Sweeps every Cloudflare zone for records pointing at a target nobody owns, asking each connected provider whether a live resource still serves it	Scheduled — daily	2

Code, supply chain & SDLC

Agent	Coverage	Signal source	Skills
Code & Supply Chain	Tag spraying, CI/CD script injection via branch names, force pushes to default branches, repository visibility changes, branch-protection weakening, org-owner additions	GitHub	7
Claude Code Governance	Batched decisions on undecided MCP servers, use of explicitly denied servers, telemetry from outside your email domains, sessions that read a credential-shaped path and then reached the network	Claude Code telemetry + weekly sweep	4
Apex	Apex findings with branch, PR, and issue automation, plus reachability and runtime validation	Apex	3
Dependabot Alerts	Auto-fix PRs driven to green CI, backlog processing, reachability triage	GitHub	3
Cantina Bug Bounty	Closes spam, notifies on real findings, opens remediation PRs where tractable	Cantina BBP	1
Risk Assessment	Shift-left review: rates new epics for security and privacy risk before implementation, opens linked design-review issues	Scheduled — weekly Jira sweep	1
AI Agent Monitoring	ClawSight telemetry — skills, policy violations, unusual tool use	ClawSight	—

AI Agent Monitoring ships without bundled skills. Attach skills from the library, or write your own, when you create it.

Web3 & threat intelligence

Agent	Coverage	Signal source	Skills
Smart Contract Security	On-chain alert response and multisig signer monitoring, with emergency pause when contracts are compromised	Hypernative, Tenderly, Hexagate, Guardrail	2
Threat Intelligence	Advisory triage and applicability — supply-chain advisories, IOCs, attacker TTPs correlated to your environment	Threat intel webhook, RSS feeds	1

Program, GRC & platform operations

Agent	Coverage	Signal source	Skills
SOC 2 Evidence Collector	Samples vulnerability-management evidence from Clarion issues, verifies remediation PRs, delivers approved draft evidence to a matching Vanta document	Scheduled — monthly	1
New Vendor Risk Reviewer	Reviews Vanta’s newly discovered vendor queue, owner contacts, duplicates, and risk context. Its scheduled run is entirely read-only	Scheduled — weekly	1
Vendor Security Questionnaire	Drafts grounded answers and gathers evidence for inbound SIG, DDQ, VSA, and CAIQ questionnaires	On demand	1
Knowledge Maintainer	Owns periodic ingestion of connected sources into the workspace Brain and holds the editorial policy for extracted knowledge	Scheduled — hourly	1
Signal Rule Refinement	Reviews how your signal rules perform and proposes tuning to cut noise and close detection gaps	Scheduled — weekly	1
Health Repair	Supplemental repair triage for Clarion integration and monitor health issues	Clarion health issues	1

The Community Library

Templates are the starting point, not the ceiling. The Community Library carries agents and skills proven by security teams already running Clarion — take an entire agent with its skills and scheduled jobs, or lift a single skill into an agent you already have. Sign in to read full skill bodies.

Community Library

Agents and skills shared by teams running Clarion.

Creating agents

Build an agent from a template or from scratch.

Our skills

Every domain we ship skill templates for.

Monitors

Configure the event sources your agents pay attention to.

Agents on cantina.security

The product-level view of agentic response.

Getting Started

Easy ROI

Knowledge Base

Learn

Integrations

Privacy & Legal

Cloud & platform

Identity & access

Endpoint & detection

DNS & external exposure

Code, supply chain & SDLC

Web3 & threat intelligence

Program, GRC & platform operations

The Community Library

Community Library

Creating agents

Our skills

Monitors

Agents on cantina.security

​Cloud & platform

​Identity & access

​Endpoint & detection

​DNS & external exposure

​Code, supply chain & SDLC

​Web3 & threat intelligence

​Program, GRC & platform operations

​The Community Library

Community Library

Creating agents

Our skills

Monitors

Agents on cantina.security

Cloud & platform

Identity & access

Endpoint & detection

DNS & external exposure

Code, supply chain & SDLC

Web3 & threat intelligence

Program, GRC & platform operations

The Community Library