/multi-tenant-operations

name: "Blackpoint Multi-Tenant Operations"
description: >
  Partner-level Blackpoint Cyber (CompassOne) operations: the
  partner-tenant hierarchy, enumerating customer tenants, sweeping
  detections and vulnerabilities across all of them, spotting volume
  anomalies, and building per-tenant scorecards.
when_to_use: >-
  When running partner-level Blackpoint Cyber / CompassOne work across many customer tenants —
  detection sweeps, exposure rollups, and per-tenant scorecards for MSP SOC operations and QBRs.
  Use when: blackpoint multi-tenant, blackpoint partner, compassone tenants, blackpoint all
  tenants, blackpoint msp sweep, blackpoint tenant rollup, or blackpoint qbr.

Blackpoint Multi-Tenant Operations

The CompassOne partner account sees every customer tenant. This skill covers the partner-level operating loop: enumerate tenants, sweep across them, and roll up into a portfolio view.

Anti-triggers

• **`blackpoint_partners_*`** — the partners domain is a stub. Partner

scope comes from the token itself; `blackpoint_tenants_list` is the only enumeration that works.

• **Investigating one detection** — the drill-down flow is

`blackpoint-incident-response`; this skill is the sweep across tenants, not the deep dive within one.

• **A tenant portfolio in another product** — M365 tenants are

`cipp-tenants` or `inforcer-tenant-management`; Blumira client accounts are `blumira-msp`. A CompassOne tenant maps to none of them automatically.

The Partner-Tenant Model

Partner (the MSP)
  └── Tenant (customer)        ← blackpoint_tenants_list / _get
        └── Asset
              └── Detections / Vulnerabilities

Every partner-level operation starts the same way: enumerate tenants, then iterate. Never present partner output without tenant attribution on every row.

API Tools

| Tool | Purpose | |------|---------| | `blackpoint_tenants_list` | Enumerate customer tenants (filter by account, status, name search) | | `blackpoint_tenants_get` | Detail for one tenant | | `blackpoint_detections_list` | Detections — call once per tenant with `tenant_id` | | `blackpoint_vulnerabilities_list` | Vulnerabilities — call once per tenant | | `blackpoint_vulnerabilities_external_list` | External exposures per tenant | | `blackpoint_vulnerabilities_darkweb_list` | Dark-web exposures per tenant |

Common Workflows

Multi-tenant detection sweep

1. `blackpoint_tenants_list` — enumerate all customers. 2. For each tenant, `blackpoint_detections_list` filtered to a recent window and `status` in {`new`, `investigating`}. 3. Roll up: detections per tenant, severity distribution, top detection types. 4. Flag tenants with abnormal volume — a tenant well above its apparent baseline is itself the signal.

Portfolio exposure rollup (QBR prep)

1. Enumerate tenants. 2. Per tenant, pull `blackpoint_vulnerabilities_list`, `blackpoint_vulnerabilities_external_list`, and `blackpoint_vulnerabilities_darkweb_list`. 3. Build a per-tenant scorecard: fix-now vulnerability count, external-exposure count, dark-web count. 4. Rank tenants by exposure so the MSP knows where to spend remediation effort.

Morning queue triage

1. Enumerate tenants. 2. Sweep `new` detections from the last 24h across all of them. 3. Rank by severity, then tenant impact, then recency. 4. Produce a shift-ready priority list (see the `alert-response-coordinator` agent).

Edge Cases

• **Tenant scoping (403)** — a partner may not have access to every

tenant returned; a 403 on drill-down means scoping, not a bad token.

• **Pagination at scale** — `blackpoint_tenants_list` and per-tenant

detection lists can both paginate; fully page before claiming a count is complete.

• **Read-only** — partner-level work here is reporting and triage;

state changes happen in the CompassOne portal.

Best Practices

• Always start with `blackpoint_tenants_list` — never hard-code a

tenant set.

• For QBRs, combine detection and exposure rollups into one

per-tenant scorecard.

Related Skills

• [incident-response](../incident-response/SKILL.md) - Drilling into one tenant's detections
• [vulnerability-management](../vulnerability-management/SKILL.md) - Exposure data per tenant
• [api-patterns](../api-patterns/SKILL.md) - Auth, hierarchy, pagination