Claroty Risk Triage

Unified alert + vulnerability triage for OT / IoT / IoMT environments via Claroty xDome. Alerts and vulnerabilities are bundled into one skill because real incident response crosses the boundary constantly — operators investigate an alert, pivot to the affected device's CVE list, and back to the alert label.

When to Use

• Triaging Claroty xDome alerts by severity, site, or assignee
• Computing the blast radius of an alert (which devices, which protocols)
• Inspecting vulnerability findings, filtering by CVSS, and listing affected devices
• Marking a CVE as not-relevant for a specific device (mitigation in place, compensating control, patched out-of-band)
• Acknowledging, labelling, or assigning alerts during a hunt
• Handing off to ise-incident-response for endpoint quarantine or to servicenow-change-workflow for a remediation CR

MCP Server

• Server: claroty-mcp
• Command: python3 -u mcp-servers/claroty-mcp/claroty_mcp_server.py (stdio transport)
• Auth: Bearer token via CLAROTY_API_TOKEN
• ITSM: Write operations require a CHG\d+ CR; bypassed in NETCLAW_LAB_MODE=true