MySecutec workflows & playbook¶

This guide explains what MySecutec is for and the common jobs people do with it — phrased as natural-language questions you can ask an AI agent driving the mysecutec CLI, with the command sequences each maps to and how to read the results.

New to the agent setup? Read AGENTS.md first — it covers auth, JSON-first conventions, and the mutation guardrails the workflows below rely on.

What is MySecutec?¶

MySecutec is Secutec's managed-security platform. It pulls many security signals into one asset + threat model so you can see, prioritise, and act on your risk from a single place. The modules:

Module	Answers the question
Assets (TAM)	What do we own, and how important is each thing?
Threats (TAM)	What's wrong, how bad, and what have we done about it?
XDR	What are our endpoints detecting?
ASM	What does our attack surface look like from outside?
LCM	Whose credentials have leaked?
DNM	Is our data / brand exposed on the dark net?
M365 / MSC	Is our Microsoft 365 tenant configured securely?
SDNS	What malicious DNS is being blocked?
ATH	What is advanced threat hunting surfacing?
IVS	What identified vulnerabilities exist?
TPRM / Bitsight	What's our third-party / external security rating?
PDK	What phishing targets our brand?

Everything funnels into threats attached to assets. That's the key mental model: prioritise by threat severity × asset importance.

The three levers that drive prioritisation¶

Severity — critical > high > medium > low > info.
Status — system_status (what the platform thinks) and user_status (what you've decided: unsolved / accepted / false_positive / solved). Unsolved + high severity is the work queue.
Asset value — business_value (1–5) and public_facing. A critical threat on a public, business-value-5 asset outranks the same threat on an internal value-1 asset.

Getting the most out of it (operating principles)¶

Ask for counts, not pages. threats aggregate and threats filter return server-side totals instantly — far better than paging through list.
Let JSON + jq do the joining. list -o json | jq -r '.threats[].id' feeds straight into bulk commands.
Prioritise, don't enumerate. Filter by severity + unsolved + public-facing before looking at individual records.
Act in bulk, safely. Triage many findings at once with threats status; it confirms first and reports per-ID success/failure.
Export for offline / sharing. export create → export download gives a CSV for spreadsheets, audits, or tickets.
Partners: pick your context. Impersonate the right org before querying; data is scoped to the active impersonation.

Workflow 1 — "Show me what needs my attention most urgently" ⭐¶

The flagship triage workflow. Urgency = high-severity, unsolved threats on important, exposed assets, plus fresh exposure (leaked creds, dark-net).

An agent should run, in order:

# 1. Confirm context (which org / env am I looking at?)
mysecutec status -o json

# 2. The shape of the threat backlog: severity × how many are unsolved
mysecutec threats aggregate --group-by severity -o json
mysecutec threats filter -o json          # status breakdown w/ live counts

# 3. The actual urgent queue: critical/high AND unsolved, worst first
mysecutec threats list -o json \
  --severity critical --severity high \
  --user-status unsolved \
  --sort -cvss_score --limit 25

# 4. Of those, which sit on public-facing / high-value assets?
#    (cross-reference asset_id, or pull public-facing assets)
mysecutec assets list -o json --public-facing --sort -business_value --limit 25

# 5. Fresh exposure that bypasses the asset model
mysecutec lcm kpis -o json                 # newly leaked credentials
mysecutec dnm overview -o json             # dark-net / PII exposure

How to read it: report the count of critical+high unsolved threats first (that's the headline), then list the top few by CVSS, flagging any on public-facing or business-value-5 assets as "do these first." Mention any spike in leaked credentials or dark-net PII as a separate urgent track.

Example shape (one test org): 54 critical + 346 high threats, 791 unsolved overall, across 4,548 assets, with 130 leaked-credential records and 16 dark-net PII items. The agent's job is to turn that into "here are the 10 things to look at this morning."

Workflow 2 — Triage and disposition (investigate → decide → act)¶

Once you know what's urgent, work the queue:

# Inspect one finding in full, including its audit trail
mysecutec threats get <threat_id> -o json
mysecutec threats logs <threat_id> -o json

# Decide on a single threat
mysecutec threats update <threat_id> --user-status accepted --annotation-note "Risk accepted: compensating control X"

# Or clear a whole class at once (e.g. mark a batch of low-value findings false-positive)
mysecutec threats list -o json --severity low --user-status unsolved \
  | jq -r '.threats[].id' \
  | mysecutec threats status --stdin --user-status false_positive --note "Bulk: known benign"

Bulk status changes confirm before running (or pass --yes) and report how many succeeded vs failed per ID.

Workflow 3 — Posture / exposure overview (the exec or board view)¶

"Give me the headline security numbers."

mysecutec assets list --limit 1 -o json            # asset count (pagination.total)
mysecutec threats aggregate --group-by severity -o json
mysecutec threats filter -o json                    # unsolved vs solved
mysecutec xdr kpis -o json                          # endpoint detections + agents
mysecutec lcm kpis -o json                          # leaked credentials
mysecutec dnm overview -o json                      # dark-net exposure
mysecutec tprm bitsight -o json                     # external security rating
mysecutec asm kpis -o json                          # attack-surface findings

Summarise as a scorecard: assets monitored, threats by severity, % unsolved, leaked credentials, dark-net items, Bitsight grade.

Workflow 4 — Asset inventory & hygiene¶

"What do we own, and is it tagged correctly?"

mysecutec assets list -o json --type domain --public-facing   # public domains
mysecutec assets filter -o json                                # valid types/modules + counts
mysecutec assets get <asset_id> -o json
mysecutec assets threats <asset_id> -o json                    # what's wrong with this asset

# Re-prioritise: bump business value on the crown-jewel assets in one shot
mysecutec assets list -o json --search "prod" \
  | jq -r '.assets[].id' \
  | mysecutec assets business-value --stdin --value 5

Good business_value / public_facing hygiene is what makes Workflow 1's prioritisation meaningful.

Workflow 5 — Leaked-credential response¶

"Whose credentials are out there, and from which breaches?"

mysecutec lcm kpis -o json                  # totals: breaches / leaks / stealers
mysecutec lcm breaches -o json              # grouped by breach source
mysecutec lcm categories -o json            # by category
mysecutec lcm stealers -o json              # infostealer-sourced
mysecutec threats list -o json --module lcm --user-status unsolved

Then drive resets/notifications off the affected accounts. This data is sensitive — report aggregates by default, raw records only when asked.

Workflow 6 — Dark-net & brand monitoring¶

mysecutec dnm overview -o json              # counts by item type
mysecutec dnm pii -o json                   # PII exposure
mysecutec dnm blackmarket -o json
mysecutec dnm botnet -o json
mysecutec pdk top-phishing-domains -o json  # phishing domains targeting the brand

Workflow 7 — Microsoft 365 security review¶

mysecutec m365 kpis -o json
mysecutec m365 admins -o json                       # who has admin
mysecutec msc tenant <tenant_id> -o json            # tenant posture overview
mysecutec msc ca-policies <tenant_id> -o json       # conditional-access coverage
mysecutec msc signins <tenant_id> --start 2026-06-01 --end 2026-06-30 -o json
mysecutec msc licenses <tenant_id> -o json

Find the tenant_id from the tenant asset (assets list --type tenant -o json).

Workflow 8 — Trends, reporting & evidence¶

"How are we trending, and give me something I can share."

mysecutec xdr years -o json
mysecutec xdr year-kpis --year 2026 -o json         # year-over-year (also asm/lcm/sdns/ath/ivs)
mysecutec ath map -o json                            # alert geography

# Generate / fetch a PDF report for stakeholders
mysecutec report list -o json
mysecutec report generate --module xdr               # (mutation — confirms first)
mysecutec report download <report_id> --output-file report.pdf

# Or pull raw data into a spreadsheet
mysecutec export create --resource threats --columns id,name,severity,user_status,first_seen_at
mysecutec export list -o json                        # wait for download_available: true
mysecutec export download <export_id> --output-file threats.csv

Exports and reports are asynchronous: create/generate queue the job; poll list until it's ready, then download.

Workflow 9 — Partner / MSP (many organisations)¶

mysecutec orgs impersonation-tree -o json            # partners → clients you can manage
mysecutec orgs list --search acme -o json            # find a specific org
mysecutec impersonate <org_id>                       # switch context (stateful!)
#   ...run any of the workflows above against that org...
mysecutec impersonate clear                          # always reset when done

Always tell the user which org the numbers belong to, and clear impersonation afterwards.

Workflow 10 — Notifications & settings¶

mysecutec notification unread-count -o json
mysecutec notification inbox --unread -o json         # uses --page / --page-size
mysecutec notification read <id>                       # or --all
mysecutec notification settings get -o json
mysecutec report settings get -o json                  # how/when reports are delivered

Cheat sheet: question → command¶

You ask…	Start with…
What needs attention now?	`threats list --severity critical --severity high --user-status unsolved --sort -cvss_score`
How many critical threats?	`threats aggregate --group-by severity`
Break X down by Y	`threats aggregate --group-by <field> --module <m>`
What's wrong with this asset?	`assets threats <asset_id>`
Are we leaking credentials?	`lcm kpis` then `lcm breaches`
Are we on the dark net?	`dnm overview` then `dnm pii`
What's our external rating?	`tprm bitsight`
Mark these as handled	`threats status --stdin --user-status <s>`
Give me a CSV / PDF	`export create …` / `report generate …`
Look at client X (partner)	`impersonate <org_id>`