Connects your cloud accounts, clusters, and hosts to Sysdig Secure.

The skill can:

• Connect AWS, GCP, and Azure cloud accounts
• Connect Kubernetes clusters, including Windows nodes, and Linux hosts
• Set up serverless workload scanning for AWS ECS and Fargate, AWS Lambda, and GCP Cloud Run
• Generate Terraform configurations for cloud accounts and Helm values for Kubernetes
• Validate prerequisites, deploy configurations, and verify connectivity
• Run as a guided interview or as an autonomous, all-at-once workflow

sysdig-account-setup

Applies a baseline configuration to a Sysdig Secure tenant after it is connected. The skill works through the Sysdig MCP Server.

The skill can:

• Establish an access baseline of teams, users, and roles
• Establish a vulnerability management policy baseline for the pipeline and runtime stages, either as a single policy or split across stages
• Assign compliance posture policies, such as CIS, PCI, and NIST, to zones
• Enable or disable the recommended managed runtime threat detection policies
• Review the current configuration, propose a structure, and apply changes repeatably, confirming with you before any change that modifies the tenant

Use this skill immediately after onboarding to leave an account usable out of the box. Fine-grained policy tuning is out of scope.

sysdig-sysql

Writes, debugs, and explains SysQL graph queries against the Sysdig security datastore.

The skill can:

• Write and debug SysQL queries, and explain what an existing query does
• Query inventory, vulnerability, posture, identity, and runtime data
• Explore the SysQL schema, including entities, fields, and relationships
• Validate the entities and fields in a query against the live schema before running it
• Present results together with suggested follow-up queries

sysdig-investigate

Identifies and prioritizes vulnerable container images in Sysdig-monitored environments.

The skill can:

• Work through a Plan configured by an administrator, or explore ranked jobs under a scope and measure you choose
• Walk the prioritized remediation jobs one at a time
• Filter, regroup, sort, and page through vulnerability findings the way the Vulnerability Management table does
• Hand a selected image off to sysdig-remediate

This skill does not open pull requests, apply fixes, or create tickets. Use sysdig-remediate for that work.

sysdig-remediate

Remediates a specific vulnerable container image and delivers the fix. This is the only skill in the vulnerability workflow that creates tickets.

The skill can:

• Retrieve Critical and High CVEs from Sysdig
• Identify a safe fix version through dependency chain analysis
• Check existing jobs, tickets, and pull requests first, so that work already in progress is not duplicated
• Open a pull request or merge request in GitHub or GitLab, or generate a .patch file for a local repository
• Create or update the corresponding Jira ticket
• Record artifacts on the remediation job and close the job once the work is filed

sysdig-posture

Authors Sysdig Secure Posture custom controls and custom policies.

The skill can:

• Author Rego-based custom controls
• Create custom policies, including grouping existing controls such as CIS into a policy of your own
• Validate Rego
• Generate Terraform using the Sysdig Terraform provider
• Discover existing policies and controls

API access is read-only. All configuration changes are managed through Terraform.

sysdig-runtime-investigate

Investigates runtime threats detected by Sysdig.

The skill can:

• Surface the highest-priority runtime threat
• Enumerate the affected container images
• Score correlations between vulnerabilities and runtime activity on a confidence scale of 1 to 5
• Analyze network blast radius, or perform VirusTotal lookups for suspicious binaries, depending on the class of event
• Reconstruct the affected workload’s commands, network connections, and file accesses as a timeline around the detection
• Escalate the investigation to Jira or PagerDuty

sysdig-runtime-remediate

Responds to a runtime threat that Sysdig has detected.

The skill can:

• Turn the context gathered during an investigation into proposed response actions
• Analyze the blast radius on the affected workload
• Isolate, stop, or pause an affected container
• Carry out or file the actions you approve, one at a time and with explicit confirmation