Mike Swanson
f55b8d2556
Mail.Send is NOT an open decision or a 'blocked' item: the Exchange Operator tier (b43e7342) already holds Graph Mail.Send + Mail.ReadWrite + MailboxSettings.ReadWrite (the suite's IR victim-notification mail path). /mailbox (ACG own-mail) separately uses the dedicated ComputerGuru Mailbox app 1873b1b0. The deleted fabb3421/Claude-MSP-Access app is now referenced only as DELETED/do-not-use across all live surfaces. Corrected: remediation-tool gotchas.md (removed 'suite has no mail scopes / mailbox BLOCKED / decision-not-executed'), commands/mailbox.md (header + Attribution no longer name the deleted app as active), feedback memory (promoted 'suite has Mail.Send — settled' to a headline), breach-report template, .grok mirrors, credentials.md, CATALOG_SHARED_DATA.md, and wiki (internal-infrastructure, glaztech, dataforth). Removed dead plaintext secret for the deleted app from CATALOG_SHARED_DATA.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
26 lines
2.0 KiB
Markdown
26 lines
2.0 KiB
Markdown
---
|
|
name: remediation-tool
|
|
description: >
|
|
M365 tenant investigation and remediation using the ComputerGuru tiered MSP app suite (Security Investigator, Exchange Operator, User Manager, Tenant Admin, Defender Add-on). Gated writes. Use when the user says "remediation tool", "365 remediation", "check <user> mailbox", "breach check", "tenant sweep", "inbox rules for <user>", or any M365 Graph/Exchange admin task.
|
|
---
|
|
|
|
# /remediation-tool — M365 Investigation & Remediation
|
|
|
|
**Grok skill for the shared command.** Full details, safety gates, and the 5-app suite description are in `.claude/commands/remediation-tool.md` and the implementation in `.claude/skills/remediation-tool/`.
|
|
|
|
**Important posture (from CLAUDE.md and the skill):**
|
|
- Read-only by default.
|
|
- All write/remediation actions are **gated** behind explicit `--confirm` or user approval.
|
|
- Use the skill's structured flows for tenant sweeps, password spray detection, inbox rule enumeration, mailbox searches, etc.
|
|
- NOT for CIPP — this is the direct Graph API tiered app suite (Security Investigator / Exchange Operator / User Manager / Tenant Admin / Defender). The old single `fabb3421`/Claude-MSP-Access app was DELETED 2026-06-14 — do not reference it. Mail.Send lives in the Exchange Operator tier (b43e7342).
|
|
|
|
When invoked:
|
|
- Read the command doc `.claude/commands/remediation-tool.md`.
|
|
- Read the full skill `.claude/skills/remediation-tool/SKILL.md` (it has the detailed model).
|
|
- Use tools to run the underlying Python/Graph scripts (via `run_terminal_command` after activating the right env/venv if needed).
|
|
- For any credential or token work, go through the vault or 1password skill.
|
|
- Follow all compliance/audit logging requirements in the skill.
|
|
|
|
This is heavily used in remediation mode. The skill itself is already a proper SKILL.md, so this Grok wrapper mainly ensures `/remediation-tool` shorthand works and points to the source.
|
|
|
|
See the remediation-tool skill directory for the actual implementation scripts and rules. |