armoctl-runtime-rules
Runtime detection rules — CRUD on the per-rule policy surface (the ARMO equivalent of a Falco rule). Use to add, modify, or evaluate runtime rules.
Install
With your agent
Install OMGSkills skill "armosec/armoctl:skills/armoctl-runtime-rules" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/armosec/armoctl /tmp/armoctl && ln -s /tmp/armoctl/skills/armoctl-runtime-rules ~/.claude/skills/armoctl-runtime-rulesFrom README
armoctl-runtime-rules A rule is the smallest unit of runtime detection: 'fire when X happens.' Rules are bundled into runtime policies (next cluster). Custom rules have ruleType 'Custom'; ARMO-managed rules have ruleType 'Managed' and cannot be deleted. Commands create — Create a runtime rule Flags: --description (string) Rule description --name (string) Rule name (required) --policy-types (stringSlice) Policy types (e.g.
More from this repo
armoctl
ARMO security platform CLI — JSON-first agent-friendly access to runtime incidents, vulnerabilities, posture, risks,...
armoctl-attack-chains
Attack chains — multi-step kill-chain views built by ARMO from runtime + posture signal.
armoctl-cloud-accounts
Cloud account onboarding — list/connect/disconnect ECS accounts.