armoctl-incidents
ARMO runtime incidents — list active threats, fetch alerts on a single incident, explain an incident's signal, resolve/silence incidents. Use when investigating live runtime alerts or post-mortems.
Install
With your agent
Install OMGSkills skill "armosec/armoctl:skills/armoctl-incidents" into this agent's normal skills directory: use the OMGSkills MCP get_skill tool, install only the pinned_install commit and path, verify SKILL.md against pinned_install.skill_md_sha, and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/armosec/armoctl /tmp/armoctl && ln -s /tmp/armoctl/skills/armoctl-incidents ~/.claude/skills/armoctl-incidentsFrom README
armoctl-incidents The incidents cluster is the live runtime-threat surface. An incident is the unit of triage; it bundles many alerts produced from runtime detection rules. Severity is ARMO-policy-adjusted, not raw alert severity. Use 'incidents alerts ' to get the full alert payload behind an incident before resolving it.
More from this repo
armoctl
ARMO security platform CLI — JSON-first agent-friendly access to runtime incidents, vulnerabilities, posture, risks,...
armoctl-attack-chains
Attack chains — multi-step kill-chain views built by ARMO from runtime + posture signal.
armoctl-cloud-accounts
Cloud account onboarding — list/connect/disconnect ECS accounts.