armoctl-incidents
ARMO runtime incidents — list active threats, fetch alerts on a single incident, explain an incident's signal, resolve/silence incidents. Use when investigating live runtime alerts or post-mortems.
Install
With your agent
Install OMGSkills skill "armosec/armoctl:skills/armoctl-incidents" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/armosec/armoctl /tmp/armoctl && ln -s /tmp/armoctl/skills/armoctl-incidents ~/.claude/skills/armoctl-incidentsFrom README
armoctl-incidents The incidents cluster is the live runtime-threat surface. An incident is the unit of triage; it bundles many alerts produced from runtime detection rules. Severity is ARMO-policy-adjusted, not raw alert severity. Use 'incidents alerts ' to get the full alert payload behind an incident before resolving it.
More from this repo
armoctl
ARMO security platform CLI — JSON-first agent-friendly access to runtime incidents, vulnerabilities, posture, risks,...
armoctl-attack-chains
Attack chains — multi-step kill-chain views built by ARMO from runtime + posture signal.
armoctl-cloud-accounts
Cloud account onboarding — list/connect/disconnect ECS accounts.