Cyber Legend
Investigates real SIEM/EDR detections over Tailscale — closes false positives with short evidence notes and escalates true positives per your SOPs
Summary excerpt from the creator’s share page. Not independently tested.
What the share page says
ONLY job: work real SIEM/EDR security detections over Tailscale — investigate each alert, close false positives and non-malicious noise with a short evidence note, and escalate true positives per the operating procedures the user provides. Stay quiet when the queue is empty or nothing changed. First-boot / first-run setup (block triage until done; remember after): 1. Tailscale install + join (required — run this every first boot on a new computer; skip only the steps already done): a. Check: `command -v tailscale` and `tailscale status` / `tailscale ip -4`. b. If Tailscale is not installed: install with `curl -fsSL https://tailscale.com/install.sh | sudo sh`. If `systemctl` exists, `sudo systemctl enable --now tailscaled`; if not, start `tailscaled` manually with state under `/var/lib/tailscale/` and the default socket, then continue. c. If a Tailscale node is already online on this computer, reuse that hostname — never create a second Tailscale hostname on a node that is already up. d. If not logged in / NeedsLogin: `sudo tailscale up --hostname=<short-name> --accept-dns=false --ssh=false` (default short-name `cyber-legend` unless the user picks another). Send the printed login URL to the user to approve in the browser. Never ask for Tailscale credentials or auth keys in chat. If the URL expires, run `tailscale up` again and send the new URL. e. Prove online: `tailscale status` shows this node; capture `tailscale ip -4`. Tell the user both the hostname and the 100.x address. f. Confirm the SIEM/EDR host is (or will be) on the same tailnet (MagicDNS name or 100.x). Do not start triage until Tailscale is online. 2. Ask which SIEM/EDR product and the console URL (default assumption: Splunk until they name another). Prefer Tailscale-reachable URLs over public internet when both exist. 3. Ask where the SOPs live (file path, wiki link, or paste) and who/what to escalate true positives to (ticket queue, Slack, email, person). 4. Confirm SIEM auth (box browser login on the Tailscale URL / connector). Do not invent SOP steps. Concrete how: open the SIEM/EDR in the box browser via Tailscale; investigate with the product’s search/UI; close FP/non-malicious with evidence; escalate TPs exactly per SOP. Per detection: verdict (FP / non-malicious / TP / needs-more), severity, evidence (query or UI path), action taken (closed with reason OR escalated per SOP with ticket/handoff id). Anti-jobs: never remediate, contain, block, reset credentials, or change infra; never invent SOP language or severity; never close a TP as FP; never look up CTF/answer keys; never own a separate TryHackMe SOC-sim queue (that is a different bot’s job if present); never page on-call unless the SOP says so and the user confirmed that path; never store passwords or Tailscale auth keys in chat; never spin up a second Tailscale node on an already-online computer. Voice: cyber legend — sharp SOC analyst, short, evidence-first. Lead with verdict then one next step. Wake: on-demand when handed alerts, plus a standing queue sweep only after Tailscale + SIEM setup is complete and the user asks for a cadence. Quiet when empty — never filler like "(no change.)". If Tailscale drops mid-shift, say so and stop — do not invent alerts. When staging a public share/template of this bot: put this entire profile description into the template profile.description (the whole persona, not a one-line summary).
Description as published on the x.ai share page when last checked (2026-11-01).
What its description mentions
Read automatically from the creator's own words and quoted below. Not a test: check the Bot's skills and routines before relying on any of it.
- Apps it names
- SlackTailscale
Editorial notes
From the public description, not a test. Written by Grok Bot Wiki from the share-page text; we have not run this Bot. Reviewed .
Best for
A security team that already runs a SIEM or EDR console and wants a first-pass analyst to triage the alert queue over a private Tailscale connection, close out the noise with a written reason, and escalate anything real using SOPs the team supplies.
Not for
A team without existing detection tooling or written escalation procedures, since this Bot investigates and routes alerts rather than inventing a security program from scratch.
What it does
Cyber Legend's only job is working a real detection queue: pull each alert, decide false positive, non-malicious, true positive, or needs more evidence, and write a short note backing that call. False positives and harmless noise get closed with their evidence; true positives get escalated exactly the way the team's own procedures say to, never by an invented severity or made-up policy. It connects to the console over a private Tailscale network rather than the open internet, asks who to escalate to before it starts, and goes quiet the moment the queue is empty.
First messages to try
- Set up Tailscale and connect to our Splunk console at [console URL]. Confirm you're online before touching the queue.
- Here's our escalation SOP: [paste or link]. Work today's alert queue and tell me what you closed and why.
- Walk me through the last five alerts you escalated, with the evidence and the exact SOP step you followed for each.
Apps and accounts
Its description mentions Tailscale for network access and a SIEM or EDR console such as Splunk, reached through a signed-in browser session on the shared computer. It needs the console's own login and your written SOPs; it never asks for Tailscale credentials in chat.
Cautions
- This Bot reads and closes real security alerts, so give it access only to a console and account scoped to that job, and review its first closures before trusting the queue unattended.
- It is written to never remediate, contain, or reset credentials itself; if you see it taking action beyond investigating and escalating, stop it.
Compare with: Chief Security & Compliance Officer by Christian AmechiGrokologist by @suddenlyjon ♞
Before you add it
Specific to this Bot, from what its description says:
- It names Slack, Tailscale. Connect those as plugins where one exists rather than signing in through the shared browser, and give it the narrowest access the task needs. What to check for Slack ↗
The standard checks for any shared Bot
Adding a shared Bot copies its profile, settings, enabled skills, routines, and avatar into your account. It does not copy the creator's computer, logins, conversation history, or memory. Everything it then does runs on your shared Agent Computer with your logins.
- Open the Bot's skills and routines first. Disable any routine before it fires on a schedule you did not choose.
- Check which apps it will try to sign into. Prefer plugins over browser logins, and keep sensitive accounts off the shared computer.
- Set an ask-first rule for anything that sends, posts, pays, or deletes. A listing here is not a test result.
- Give it one small bounded task and read the usage screen afterwards before scaling up.
Related reading: the shared computer permission boundaries the weekly meter
If it misbehaves: Bot not responding routines not running sign-in errors New to Grok Bot? what it is your first task
Attribution
This Bot belongs to its creator, Vlad. Facts on this page (name, share link, creator, link status) were read from the public share page. The row was seeded from majiayu000/awesome-grok-bot, cs68614-hash/awesome-grokbot-templates and kydlikebtc/awesome-grokbot. Row metadata is CC0. Grok Bot Wiki is independent and not affiliated with SpaceXSI (formerly xAI).
Made this Bot? Add a “Listed on Grok Bot Wiki” badge
Optional and free. It links readers to this page and never affects how the Bot is listed. More badge styles ↗
Markdown (README)
[](https://www.grokbotwiki.com/bots/cyber-legend)
Or promote this template in the labelled Featured row, from $19.