Skip to main content
Learn how agents triage alerts, investigate incidents, and execute response actions in your security stack. Agents are AI-powered responders that investigate every alert. They get the alerts, pick the right skill to follow, run tools to gather context, and either close the alert, escalate it to an incident, or ask a human for approval to continue.

​
What an agent is

An agent is a configured responder defined by:
  • Monitors: The alert sources it pays attention to.
  • Skills: A skill is a reusable playbook that teaches the agent how to perform a specific class of tasks to a known standard, along with the tools available to investigate and remediate security alerts.
  • Tools: The actions it can execute, assigned through skills (Slack, DNS, Jira, AWS, and more).
  • Notification preferences: How it requests human approval or clarification.
Start from a template, with pre-built agents for common SOC workflows like Smart Contract Security, Identity & Access, or DNS Infrastructure, or build one from scratch.

​
What an agent does

  • Triages alerts: Produces a summary, report, recommendations, and risk assessment for every alert that matches its monitors.
  • Investigates incidents: Runs deeper analysis when an alert is escalated.
  • Executes response: Calls tools to remediate (revoke a token, change a DNS record, post to Slack, file a Jira ticket).
  • Asks for approval: Requests human approval before sensitive actions, or clarification when input is needed to proceed.
  • Resumes: Suspended or paused investigations resume automatically once a human responds.
Agents only do what their skills tell them to do. The right way to change an agent’s behavior is to update or add a skill, not to rewrite the agent itself.
Creating agents - Build an agent from a template or from scratch. Monitors - Configure the alert sources your agents pay attention to.

​
Creating agents

Build an agent from a template, customize its skills and monitors, and put it into production. You can create an agent in two ways: start from a curated template, or build one from scratch.

​
Start from a template

Templates are pre-built agents for common workflows. Each bundles a set of monitors, skills, and signal rules tuned for a specific domain.
  • Smart Contract Security: Monitors on-chain activity, triages exploits, coordinates emergency pause workflows.
  • Identity & Access: Tracks Okta, Microsoft Entra, JumpCloud, and 1Password events for impossible-travel, MFA bypass, and policy weakening.
  • DNS Infrastructure: Watches your zones for unauthorized record changes, NS hijack, and dangling subdomains.
  • Cloud Posture: CloudTrail, GuardDuty, and CloudWatch for AWS, with agent-driven IAM investigation.
To create from a template:
  1. Open Agents in your workspace and click New agent.
  2. Pick the template that matches your use case.
  3. Review the bundled monitors, skills, and signal rules.
  4. Configure notification channels. See Notifications.
  5. Activate the agent.

​
Build from scratch

If no template fits, start with a blank agent.
  1. Open Agents and click New agent → Blank.
  2. Add monitors for the signals you want the agent to handle.
  3. Add skills that describe how to respond. Use the skill library or write custom skills.
  4. Configure notification preferences.
  5. Activate.
You can fork a template at any time. Forked templates are managed copies you can edit; they keep the lineage so you can reset back to the template default.
Learn about Skills →

​
Monitors

Configure the alert sources your agents listen to: webhooks, polling integrations, and active checks. Monitors are the alert sources for your agents. Each monitor connects to an external tool, polls an API, or runs an active check.

​
Monitor types

Clarion supports monitor types across these categories:
  • Identity & Access: Okta, Microsoft Entra ID, JumpCloud, 1Password, Google Workspace.
  • Cloud: AWS CloudTrail, AWS GuardDuty, AWS CloudWatch, GCP Cloud Logging, GCP Cloud Monitoring, GCP Security Command Center, Vercel.
  • Source code: GitHub, Apex.
  • On-chain: Hypernative, Hexagate, Tenderly.
  • Endpoint: CrowdStrike Falcon, Huntress.
  • Observability: Datadog, Grafana, Falco.
  • Infrastructure checks: DNS zone monitoring, Better Stack uptime alerts.
  • Generic: Webhook for any tool that can POST JSON.
Each Integration page describes how to set up monitors for that tool.

​
What you can do

  • Create a monitor or multiple monitors for each connected tool, with type-specific configuration.
  • Filter which events come through by severity or other criteria the monitor type supports.
  • Enable / disable monitors without losing configuration.
  • Assign monitors to agents so the right responder picks up each signal.
Signals from a monitor become alerts only when a signal rule matches them. If you’re seeing signals but no alerts, check the rules attached to that monitor.