Skip to main content
The common use is a triggered agent on RocketCyber tickets: the agent reads the incident named in the ticket title, its detection events and the device, finds how earlier tickets for the same detection were resolved, and writes the technician an internal note with the evidence, RocketCyber’s remediation advice, the next steps and any suppression rule to add.
Automatically enabled when you configure RocketCyber permissions in your agent workflow.

​
What It Does

  • Read incidents, with RocketCyber’s remediation advice, by id, status, title or date
  • Read the detection events behind an incident, and event summaries per detection app
  • Read agents (devices) with their connectivity, OS and last connection, and firewalls
  • Read suppression rules, active or expired
  • Read Microsoft Defender health and risk per device, and Microsoft 365 secure score per customer
Neo reads RocketCyber and changes nothing there. To act on what it finds, the agent uses the RMM or Microsoft 365 tools you give it, under their own approval rules, and tells the technician what to change in the RocketCyber console.

​
Permission Groups

Every group is read only.

​
Setup

See Connecting RocketCyber to Neo.