> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clarion.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.
# Our agents
> Every agent template Clarion ships, what it watches, and how many skills it brings with it.
Clarion ships **33 agent templates**. Each one bundles the monitors it listens to, the skills that tell it how to respond, and — for the scheduled ones — a recurring job. Create an agent from a template and it arrives configured; fork any skill afterwards to make it yours.
Templates come in two shapes:
* **Monitor-driven** — the agent wakes up when a connected integration sends an event, and triages the issue that event produces.
* **Scheduled** — the agent has no monitors. It runs a recurring sweep against your connected tools and files issues from what it finds. Deactivating the agent pauses the sweep.
## Cloud & platform
| Agent | Coverage | Signal source | Skills |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------- | ------ |
| **Cloud Security (AWS)** | IAM privilege escalation, root-account use, credential exposure, compute compromise, data exfiltration, log tampering | CloudTrail, GuardDuty | 10 |
| **Amazon Inspector** | Package CVE, code vulnerability, and network-reachability triage with AWS asset blast-radius estimation | Amazon Inspector | 2 |
| **Cloud Security (Azure)** | Defender for Cloud alerts, Entra ID and RBAC privilege abuse, Storage and Key Vault exposure, network and compute compromise, Secure Score remediation | Defender for Cloud | 10 |
| **Cloud Security (GCP)** | Audit-log privilege abuse, service-account key compromise, unauthorized compute, Security Command Center findings | Cloud Logging, Security Command Center, Cloud Monitoring | 7 |
| **Wiz** | CNAPP issues routed by type — toxic combinations, threat detections, entitlement findings, vulnerability exposure | Wiz Issues | 5 |
| **Cloudflare Notifications** | DDoS and WAF attacks, origin and edge availability, DNS and zone integrity, certificate lifecycle, client-side security | Cloudflare Notifications | 5 |
| **Cloudflare Logpush** | L7 DDoS detection windows, origin exposure and DNS bypass checks, incident handoff | Cloudflare Logpush (`firewall_events`) | 3 |
| **Vercel Platform** | Deployment failures, runtime errors, firewall attacks, domain health, production rollback | Vercel | 3 |
| **Infrastructure & Ops** | Uptime and outage runbooks, host threats, suspicious SSH activity | Grafana, Better Stack, Falco | 1 |
## Identity & access
| Agent | Coverage | Signal source | Skills |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | ------ |
| **Identity & Access** | Impossible travel, brute force, MFA attacks and session hijacking, OAuth and app abuse, admin compromise, federation abuse, policy weakening, phishing response | Okta, Google Workspace, JumpCloud | 14 |
| **1Password** | Burst failed sign-ins, user suspension, vault item exports and the grant-then-export sequence | 1Password Events Reporting | 4 |
## Endpoint & detection
| Agent | Coverage | Signal source | Skills |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | ------ |
| **Microsoft Sentinel & Defender XDR** | Incident triage and KQL hunting, plus scenario playbooks for identity compromise, phishing, endpoint forensics, ransomware scoping, Azure control-plane attacks, UEBA anomalies | Microsoft Sentinel | 8 |
| **Endpoint Monitoring** | Script and LOLBin execution, persistence, credential access, sensor tampering, lateral movement, C2 and exfiltration, ransomware | CrowdStrike Falcon | 9 |
| **Microsoft Defender XDR** | Correlated incident hydration with Entra pivots, routed to identity scenario playbooks | Microsoft Defender XDR | 5 |
| **SentinelOne** | Threat triage, investigation and scoping, gated containment, false-positive handling and exclusions | SentinelOne Singularity | 4 |
| **Huntress** | Verifies the Huntress SOC's report, reconstructs the attack chain, then hands containment to your EDR or identity path — Huntress is read-only in Clarion | Huntress Managed EDR/MDR, ITDR | 3 |
## DNS & external exposure
| Agent | Coverage | Signal source | Skills |
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ------ |
| **DNS & Domain Security** | Record and subdomain changes, email-auth (SPF/DKIM/DMARC) changes, new subdomain discovery, registrar hijack, DNS tunneling, DDoS amplification | DNS monitor | 7 |
| **Exposure Agent** | Sweeps every connected provider for deployments reachable from the public internet that were not meant to be, and remembers verdicts so known-public sites stop re-reporting | Scheduled — daily | 4 |
| **Dangling Subdomain Agent** | Sweeps every Cloudflare zone for records pointing at a target nobody owns, asking each connected provider whether a live resource still serves it | Scheduled — daily | 2 |
## Code, supply chain & SDLC
| Agent | Coverage | Signal source | Skills |
| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------ | ------ |
| **Code & Supply Chain** | Tag spraying, CI/CD script injection via branch names, force pushes to default branches, repository visibility changes, branch-protection weakening, org-owner additions | GitHub | 7 |
| **Claude Code Governance** | Batched decisions on undecided MCP servers, use of explicitly denied servers, telemetry from outside your email domains, sessions that read a credential-shaped path and then reached the network | Claude Code telemetry + weekly sweep | 4 |
| **Apex** | Apex findings with branch, PR, and issue automation, plus reachability and runtime validation | Apex | 3 |
| **Dependabot Alerts** | Auto-fix PRs driven to green CI, backlog processing, reachability triage | GitHub | 3 |
| **Cantina Bug Bounty** | Closes spam, notifies on real findings, opens remediation PRs where tractable | Cantina BBP | 1 |
| **Risk Assessment** | Shift-left review: rates new epics for security and privacy risk before implementation, opens linked design-review issues | Scheduled — weekly Jira sweep | 1 |
| **AI Agent Monitoring** | ClawSight telemetry — skills, policy violations, unusual tool use | ClawSight | — |
**AI Agent Monitoring** ships without bundled skills. Attach skills from the library, or write your own, when you create it.
## Web3 & threat intelligence
| Agent | Coverage | Signal source | Skills |
| --------------------------- | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------ | ------ |
| **Smart Contract Security** | On-chain alert response and multisig signer monitoring, with emergency pause when contracts are compromised | Hypernative, Tenderly, Hexagate, Guardrail | 2 |
| **Threat Intelligence** | Advisory triage and applicability — supply-chain advisories, IOCs, attacker TTPs correlated to your environment | Threat intel webhook, RSS feeds | 1 |
## Program, GRC & platform operations
| Agent | Coverage | Signal source | Skills |
| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------- | ------ |
| **SOC 2 Evidence Collector** | Samples vulnerability-management evidence from Clarion issues, verifies remediation PRs, delivers approved draft evidence to a matching Vanta document | Scheduled — monthly | 1 |
| **New Vendor Risk Reviewer** | Reviews Vanta's newly discovered vendor queue, owner contacts, duplicates, and risk context. Its scheduled run is entirely read-only | Scheduled — weekly | 1 |
| **Vendor Security Questionnaire** | Drafts grounded answers and gathers evidence for inbound SIG, DDQ, VSA, and CAIQ questionnaires | On demand | 1 |
| **Knowledge Maintainer** | Owns periodic ingestion of connected sources into the workspace Brain and holds the editorial policy for extracted knowledge | Scheduled — hourly | 1 |
| **Signal Rule Refinement** | Reviews how your signal rules perform and proposes tuning to cut noise and close detection gaps | Scheduled — weekly | 1 |
| **Health Repair** | Supplemental repair triage for Clarion integration and monitor health issues | Clarion health issues | 1 |
## The Community Library
Templates are the starting point, not the ceiling. The **[Community Library](https://clarion.cantina.xyz/community)** carries agents and skills proven by security teams already running Clarion — take an entire agent with its skills and scheduled jobs, or lift a single skill into an agent you already have. Sign in to read full skill bodies.
Agents and skills shared by teams running Clarion.
Build an agent from a template or from scratch.
Every domain we ship skill templates for.
Configure the event sources your agents pay attention to.
The product-level view of agentic response.