Security 🧪 Community ✓ Claude Code ✓ Claude Desktop 🔌 Requires MCP Server • Kaseya
RocketCyber
RocketCyber managed SOC - incidents, agents, events, threat detection
🔌 Recommended MCP Server
Pair this plugin with the RocketCyber MCP for direct API access alongside skills and commands.
Installation
Install this plugin individually:
/plugin marketplace add wyre-technology/msp-claude-plugins --plugin rocketcyber Or install all MSP plugins at once:
/plugin marketplace add wyre-technology/msp-claude-plugins Features
- Account Hierarchy
- Agent Monitoring
- Application Inventory
- Incident Management
Skills
This plugin provides 5 skills that teach Claude about RocketCyber:
| Skill | Description |
|---|---|
accounts | RocketCyber's provider/customer account hierarchy: sub-account navigation, account CRUD operations, account settings, security policy configuration, and multi-tenant MSP patterns. |
agents | RocketCyber agent (RocketAgent) deployment, communication status, health monitoring, and troubleshooting: agent installation, online/offline status, agent-to-account mapping, and platform support. |
apps | RocketCyber application inventory: detecting, categorizing, and monitoring applications across managed endpoints, including approved-vs-unapproved software, app-level threat detection, and software compliance reporting. |
incidents | RocketCyber security incident lifecycle: severity levels, verdicts (Malicious/Suspicious/Benign), status transitions, SOC analyst triage patterns, and cross-vendor PSA ticket correlation. |
api-patterns | RocketCyber REST API v3 fundamentals: Bearer token authentication, regional base URL selection, pagination, rate limiting, error handling, and account hierarchy navigation. |
Agents
This plugin provides 2 agents for autonomous task execution:
| Agent | Description |
|---|---|
soc-alert-investigator | Use this agent when an MSP needs to investigate and triage RocketCyber SOC alerts and security incidents across their client portfolio. |
threat-correlation-analyst | Use this agent when an MSP needs to correlate RocketCyber SOC detections with broader security context from across the Kaseya ecosystem — cross-referencing incidents with Datto RMM device data, IT Glue documentation, and Autotask ticket history to build richer threat narratives and identify whether incidents are isolated or part of a broader pattern. |
Commands
Available slash commands:
| Command | Description |
|---|---|
/account-summary | Get a security posture summary for a RocketCyber customer account |
/search-incidents | Search RocketCyber security incidents by account, status, severity, verdict, and date range |
API Reference
| Base URL | |
| Authentication | |
| Rate Limit | |
| Documentation |
Example Usage
Get a security posture summary for a RocketCyber customer account
/account-summarySearch RocketCyber security incidents by account, status, severity, verdict, and date range
/search-incidentsUsing Skills
/skill rocketcyber:accounts
RocketCyber's provider/customer account hierarchy: sub-account navigation, account CRUD operations, account settings, security policy configuration, and multi-tenant MSP patterns.