SubImage

SubImage keeps a live graph of your cloud and SaaS environment: AWS, GCP, Azure, GitHub, Kubernetes, and connected SaaS apps. This connector lets Claude read and reason over that graph so you can investigate your security posture in plain language instead of clicking through dashboards.

What you can do

• Triage findings and issues. List and inspect open issues, see what's affected, assign owners, and snooze noise.
• Investigate vulnerabilities. Explore CVEs, KEV status, affected packages and containers, where they're running, and whether a fix is available, with remediation action items.
• Review attack paths. Walk attacker paths step by step, assess blast radius from any asset, and simulate what-if scenarios.
• Explore your inventory. Query assets across every connected provider, follow relationships, and open the right provider console.
• Understand exposure and ownership. Enrich IPs, trace why a resource is reachable, and resolve which team owns it.
• Query the graph directly. Run Cypher against the underlying Neo4j graph, browse the schema, and save reusable queries.
• Author custom rules and scenarios. Create tenant-local detection rules and attack-path scenarios.

Everything runs against your own authenticated SubImage tenant, scoped to your data. Requires a SubImage account.