servosity/msp-skills/blumira

Blumira - Claude Code Skill

Prerequisites: Install the CLI

This skill drives the blumira-cli binary. You must verify the CLI is installed before invoking any command from this skill. If it is missing, install it first:

1. macOS / Linux:

``bash bash <(curl -fsSL https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/blumira/install.sh) ``

1. Windows (PowerShell):

``powershell iwr -useb https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/blumira/install.ps1 | iex ``

1. Verify: blumira-cli --version
2. Ensure ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows) is on $PATH.

The installer downloads the blumira-cli and blumira-mcp binaries into ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows). It does not register the skill with your agent and writes no MCP client config - see mcp-install.md for that wire-up.

If --version reports "command not found" after install, the runtime cannot see the binary directory on $PATH. Do not proceed with skill commands until verification succeeds.

Blumira's API and the community MCP return per-account, point-in-time snapshots. This CLI syncs findings, evidence, detection rules, and agent devices from your org and every MSP client account into a local SQLite store, so you get one ranked cross-account triage queue (triage), what-changed-since-last-sync (drift), MTTR and velocity trends (velocity), SLA aging (sla), detection coverage drift vs the MSP basis (coverage), and domain-controller exposure (exposure). It also mints and auto-refreshes its own JWT from your Client ID and Secret instead of making you bring your own.

When to Use This CLI

Use this CLI when an agent or analyst needs Blumira security data across more than one client account or across time - cross-account triage, what-changed diffs, MTTR/velocity reporting, SLA aging, detection-coverage drift, or domain-controller exposure. Prefer it over raw API calls whenever the question spans accounts (MSP rollup) or spans syncs (trends, drift, re-fire), since those answers do not exist in any single Blumira endpoint.

Anti-triggers

Do not use this CLI for:

• Raw log or event search (the API exposes findings/rules/agents, not the log stream - use the Blumira console)
• Agent installation or sensor deployment (agents commands are read-only inventory)
• Non-Blumira SIEM/EDR data (use the matching vendor's connector)
• Modifying detection rules (public API is read-only for rules - tune in the Blumira console)

Unique Capabilities

Cross-account & over-time intelligence

• `triage` - One globally-ranked open-findings queue across every MSP client account.

_Reach for this to start MSP triage: it answers 'what is on fire across all my clients right now' in one ranked list instead of one account at a time._

``bash blumira-cli triage --priority high --status open --agent ``

• `drift` - New, status-changed, and newly-resolved findings since the last sync, per account.

_The shift-handoff / morning-standup answer - pick this when the user asks what is new or changed, not the full current state._

``bash blumira-cli drift --since 24h --agent ``

• `velocity` - Mean-time-to-resolve and open-rate per account or overall.

_Use for reporting and trend tracking - it is the only way to get response-time trends Blumira's API does not expose._

``bash blumira-cli velocity --window 30d --by account --agent ``

• `sla` - Findings about to breach an age-based SLA across all accounts, ranked.

_Pick this to catch findings slipping past SLA before they breach, instead of discovering breaches after the fact._

``bash blumira-cli sla --breach-in 4h --priority high --agent ``

• `coverage` - Detection rules missing or disabled in your org versus the MSP basis ruleset.

_Use to find detection rules that silently drifted away from the MSP basis baseline._

``bash blumira-cli coverage --against basis --agent ``

• `exposure` - Cross-account agent rollup that flags stale or unprotected domain controllers.

_Reach for this for billing/coverage reviews and to spot unprotected domain controllers across the whole MSP fleet._

``bash blumira-cli exposure --flag-dc-stale --agent ``

• `audit` - Findings that were resolved and then re-fired (reopened).

_Use to catch premature or low-quality resolutions that re-fired._

``bash blumira-cli audit --min-reopens 2 --agent ``

• `recurring` - The same detection firing repeatedly across accounts and time.

_Pick this to find the noisy detection or unfixed root cause that keeps generating findings._

``bash blumira-cli recurring --window 90d --min-count 3 --agent ``

• `overview` - One-screen per-account rollup: open findings by priority, agent coverage, and detection-coverage drift across every client.

_Run this first each morning: it answers 'which client needs attention' before triage answers 'which finding'._

``bash blumira-cli overview --agent ``

• `reconcile` - Flat finding-to-org-to-assignee-to-status table for diffing against ConnectWise, Jira, or Zendesk.

_Use when reconciling Blumira findings against an external ticketing system - one command replaces the manual cross-account export._

``bash blumira-cli reconcile --status open --csv ``

• `evidence-search` - Full-text search over synced finding evidence to find which findings mention an IOC, hostname, or user.

_Reach for this during threat hunting when you have an indicator but not a finding ID._

``bash blumira-cli evidence-search "rdp brute force" --agent ``

• `dc-roster` - Every domain controller across all accounts with last check-in and protected/stale state.

_Use for fleet and billing reviews needing the full DC inventory; use exposure instead for the prioritized stale/unprotected action list._

``bash blumira-cli dc-roster --agent ``

• `workload` - Open assigned findings grouped by owner across all accounts, with age buckets.

_Use when balancing analyst assignments or reviewing team load before sprint or shift planning._

``bash blumira-cli workload --agent ``

Access that beats the incumbent

• `auth login` - Mints, caches, and auto-refreshes the Blumira JWT from a Client ID + Secret.

_Use once to authenticate; every other command then just works without manually exchanging or refreshing tokens._

``bash blumira-cli auth login --client-id "$BLUMIRA_CLIENT_ID" --client-secret "$BLUMIRA_CLIENT_SECRET" ``

Command Reference

health - Manage health

• blumira-cli health - Get API health

msp - Manage msp

• blumira-cli msp add-account-finding-comment - Add a comment to a finding for your MSP sub-account
• blumira-cli msp get - Get a specific MSP sub-account by ID
• blumira-cli msp get-account-agents-devices - Get or search agents devices for your MSP sub-account
• blumira-cli msp get-account-agents-keys - Get or search agents keys for your MSP sub-account
• blumira-cli msp get-account-finding - Get a specific finding by ID for your MSP sub-account
• blumira-cli msp get-account-finding-comments - Get comments for a specific finding for your MSP sub-account
• blumira-cli msp get-account-finding-evidence - Returns evidence keys and a paginated first page of evidence rows for the finding in one call.
• blumira-cli msp get-account-findings - Get or search findings for your MSP sub-account
• blumira-cli msp get-accounts - Get or search sub-accounts for your MSP
• blumira-cli msp get-accounts-findings - Get or search findings for all your MSP sub-accounts
• blumira-cli msp get-agents-device - Get a specific agents device by ID for your MSP sub-account
• blumira-cli msp get-agents-key - Get a specific agents key by ID for your MSP sub-account
• blumira-cli msp get-detection-rule-by-account - Get a detection rule by ID for your MSP sub-account
• blumira-cli msp get-detection-rules-by-account - List detection rules for your MSP sub-account
• blumira-cli msp get-msp-detection-rule - Get a basis detection rule by ID (for MSP bulk detail)
• blumira-cli msp get-msp-detection-rules - List basis detection rules (catalog) for MSP bulk
• blumira-cli msp list-users - Get or search users for your MSP sub-account
• blumira-cli msp resolve-finding - Resolve a finding for your MSP sub-account
• blumira-cli msp set-finding-owners - Assign owners to a finding for your MSP sub-account

org - Manage org

• blumira-cli org controller-direct-add-comment - Add a comment to a finding in the org
• blumira-cli org controller-direct-get - Get a specific finding by ID
• blumira-cli org controller-direct-get-agents-device - Get a specific agents device by ID
• blumira-cli org controller-direct-get-agents-devices - Get or search agents devices
• blumira-cli org controller-direct-get-agents-key - Get a specific agents key by ID
• blumira-cli org controller-direct-get-agents-keys - Get or search agents keys
• blumira-cli org controller-direct-get-by - Get or search findings for your organization
• blumira-cli org controller-direct-get-comments - Get comments for a specific finding
• blumira-cli org controller-direct-get-details - Get details for a specific finding
• blumira-cli org controller-direct-get-detection-rule - Get a detection rule by ID
• blumira-cli org controller-direct-get-detection-rules-by - List detection rules for your organization
• blumira-cli org controller-direct-get-evidence - Returns evidence keys (schema) and a paginated first page of evidence rows for the finding in one call.
• blumira-cli org controller-direct-list-users - Get or search users for your organization
• blumira-cli org controller-direct-resolve-finding - Resolve a finding
• blumira-cli org controller-direct-set-owners - Assign owners to a finding

resolutions - Manage resolutions

• blumira-cli resolutions - Get resolution options for findings

audit

• blumira-cli audit - Findings that were resolved and then re-fired (reopened).

auth

• blumira-cli auth login - Mints, caches, and auto-refreshes the Blumira JWT from a Client ID + Secret.

coverage

• blumira-cli coverage - Detection rules missing or disabled in your org versus the MSP basis ruleset.

dc-roster

• blumira-cli dc-roster - Every domain controller across all accounts with last check-in and protected/stale state.

drift

• blumira-cli drift - New, status-changed, and newly-resolved findings since the last sync, per account.

evidence-search

• blumira-cli evidence-search - Full-text search over synced finding evidence to find which findings mention an IOC, hostname, or user.

exposure

• blumira-cli exposure - Cross-account agent rollup that flags stale or unprotected domain controllers.

overview

• blumira-cli overview - One-screen per-account rollup: open findings by priority, agent coverage, and detection-coverage drift across every client.

reconcile

• blumira-cli reconcile - Flat finding-to-org-to-assignee-to-status table for diffing against ConnectWise, Jira, or Zendesk.

recurring

• blumira-cli recurring - The same detection firing repeatedly across accounts and time.

sla

• blumira-cli sla - Findings about to breach an age-based SLA across all accounts, ranked.

triage

• blumira-cli triage - One globally-ranked open-findings queue across every MSP client account.

velocity

• blumira-cli velocity - Mean-time-to-resolve and open-rate per account or overall.

workload

• blumira-cli workload - Open assigned findings grouped by owner across all accounts, with age buckets.