# Tenable CDR Playbook

> Queries and triages Tenable Cloud Security Threat Stories into prioritized, grounded cloud IR playbooks.

- Type: Agent
- Author: wingchurn-tenable
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-07-16
- Source repository: https://github.com/wingchurn-tenable/cdr-threat-story
- Repo state: not archived
- Last push: 2026-07-10T15:08:37Z
- Stars: 1 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable, AWS, Azure, GCP
- Domains: cloud-security, security-operations
- Tags: cloud-security, tenable, cdr, cspm, aispm, soc, posture, cnapp
- Date added: 2026-07-10
- Listing page: https://exchange.tenable.com/agents/tenable-cdr-playbook
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/agents/tenable-cdr-playbook.md

The Tenable CDR Playbook is a security-analyst agent for Cloud Detection & Response.
It reads the live Threat Stories in Tenable Cloud Security (Risk > Threat Stories),
prioritizes them, and turns them into copy-paste-ready incident-response guidance —
without ever guessing. Every field it reports (accounts, ARNs, actor IDs, MITRE IDs,
and the engine's own summary/impact text) is quoted from the query; anything the query
does not return is shown as `<PLACEHOLDER>` so a command is never aimed at the wrong
resource.

## What it does

- **Triages the queue.** Pulls Open/InProgress Threat Stories, ranks them by severity,
  status, and real-world impact (loss of detection capability outranks data impact),
  and labels them P1…Pn.
- **Works three ways.** Interactive (answer a specific question), autonomous (sweep the
  whole queue and build the full playbook), and drill-down (keep asking follow-ups —
  pivot on actor, resource, account, or MITRE technique).
- **Produces deliverables.** A standard Markdown IR playbook (six sections per story:
  Overview, Triage, Containment, Eradication, Recovery, Prevention) or a professional
  HTML report with per-story attack-impact diagrams and a campaign-level map.
- **Read + suggest only.** It queries Tenable read-only and hands you the remediation
  commands to run yourself — it never executes changes against cloud resources.

## How it works

The agent (`threat-story-analyst`) and its bundled skill (`cdr-playbook`) are packaged
as a Claude Code / Cowork plugin. The data source is locked to the `ThreatStory` object
type in the Tenable Cloud Security Explorer (UDM), reached through the Tenable Cloud
Security (`tcs`) MCP connector — Findings, risks, and other object types are never
substituted as the source. The agent ranks the whole queue cheaply, then paces detailed
write-ups in priority blocks (a severity/status tier, or a campaign of related stories
kept together), offering the next block on request. Prevention steps are emitted as
reusable detection policies grounded in each story's specific behavior.

## Requirements

- Tenable Cloud Security with the **Cloud Detection & Response** capability (Threat
  Stories) and the Tenable Cloud Security MCP connector connected.
- Claude Code or Claude Cowork to run the agent/skill (installable from this repo as a
  plugin/marketplace).

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/agents/tenable-cdr-playbook.json. The full index and how to read it: https://exchange.tenable.com/llms.txt