| What new, unremediated email threats need attention right now? | abnormal | abnormal-cli triage --since 24h --top 20 |
| Whose backups succeeded, failed, or went stale across every customer last night? | acronis | acronis-cli health |
| Which endpoints across all clients are missing the most patches? | action1 | action1-cli fleet patch-posture |
| Which resources have no backup protection at all? | afi | afi-cli coverage-gaps --agent |
| Which payments failed or stalled in the last week, across every company? | appdirect | appdirect-cli payments unpaid --since 7d --json |
| Which agents have gone offline or stopped checking in? | atera | atera-cli agents stale --days 30 |
| Which approved time entries haven't been invoiced yet? | autotask | autotask-cli unbilled |
| What hardware is past or approaching end-of-support across every client? | auvik | auvik-cli eol --bucket expired |
| What did Avanan catch across my tenants since the start of my shift? | avanan | avanan-cli triage --since 24h |
| Why did my bill change month-over-month? | aws-billing | aws-billing-cli compare --from last-month --to this-month |
| Whose backups failed or went stale across every client last night? | axcient | axcient-cli health |
| Which backups are failing or silent today, new or ongoing, and how many tickets are open on each? | backup-radar | backup-radar-cli check --agent |
| What's down right now and is anyone actually paged? | betterstack | betterstack-cli down |
| Which customers have unmanaged, outdated or unscanned endpoints? | bitdefender | bitdefender-cli fleet health |
| What are the worst open findings across all my client accounts right now? | blumira | blumira-cli triage --status open |
| Which tenants still have users without MFA registered? | cipp | cipp-cli posture --dimension mfa |
| Why can't this user get through Duo, and which fix applies? | cisco-duo | cisco-duo-cli lockout triage "[email protected]" --account-id "Acme Corp" |
| Which client org is in the worst shape right now? | cisco-meraki | cisco-meraki-cli fleet health --agent |
| Which open vulnerabilities across every client are most likely to be exploited? | connectsecure | connectsecure-cli exposure --min-epss 0.5 --severity Critical,High |
| Which agents haven't checked in for 30+ days, by client? | connectwise-automate | connectwise-automate-cli stale-agents --days 30 --agent |
| Which access sessions are in this group? | connectwise-control | connectwise-control-cli sessions list --session-type Access --group "All Machines" --agent |
| Which tickets did we touch this week that have zero time logged against them? | connectwise-manage | connectwise-manage-cli unbilled --since 7d |
| Which endpoints are offline or silent for more than a day, by client? | connectwise-rmm | connectwise-rmm-cli fleet stale --older-than 24h --agent |
| Why did this client's risk score move, and which component drove it? | cork | cork-cli score attribute <client-uuid> --since 30d |
| Which devices failed their last backup since yesterday? | cove | cove-cli devices failures --since 24h --json |
| What should I triage first across all my client tenants right now? | crowdstrike | crowdstrike-cli fleet alerts --status new |
| Pull this month's invoices | datagate | datagate-cli invoices --period-start 2026-08-01T00:00:00Z --period-end 2026-08-31T23:59:59Z --json |
| Which protected machines failed their last backup screenshot verification? | datto-bcdr | datto-bcdr-cli screenshots --failed --stale-days 7 --agent |
| Which devices haven't checked in for 30 days, across every client? | datto-rmm | datto-rmm-cli fleet stale --days 30 --agent |
| Is anything on fire across all my sites? | domotz | domotz-cli fleet health --agent |
| Give me one posture verdict across every client FortiGate, showing only findings that are new since the last run. | fortinet | fortinet-cli fleet audit --new |
| Which accounts across all my clients lack 2-Step Verification, with unenrolled admins first? | google-workspace | google-workspace-cli mfa-gaps --all-tenants --agent |
| Push a whole file of usage counts and rebuild billing exactly once? | gradient | gradient-cli usage push --file ./counts.csv --agent |
| What's about to breach SLA in the next 24 hours? | halopsa | halopsa-cli sla breaching --within 24h --team Support --json |
| Which open deals have gone cold with no engagement in the last three weeks? | hubspot | hubspot-cli stale deals --days 21 --owner me |
| Which clients have the worst documentation completeness? | hudu | hudu-cli audit completeness --agent |
| Which incidents are oldest across every client org? | huntress | huntress-cli fleet-incidents --sort age |
| What failed in last night's maintenance window, by root cause? | immybot | immybot-cli session-triage --since 24h |
| Which client owns this device, serial number, or contact? | itglue | itglue-cli search "Fortinet" |
| Which tickets breach SLA in the next two hours, across every queue? | jira-service-management | jira-service-management-cli breaches --within 2h |
| Which queues are underwater and what's going stale before standup? | kaseya-bms | kaseya-bms-cli queue-health --agent |
| Who clicked the bait in more than one phishing test? | knowbe4 | knowbe4-cli repeat-clickers --min-clicks 2 --since 90d |
| Which devices are most at risk across alerts, patches, score, and staleness? | levelio | levelio-cli at-risk --top 20 |
| What changed across all my clients in the last 24 hours? | liongard | liongard-cli drift --since 24h |
| What's our current MRR and ARR right now? | maxio | maxio-cli mrr now |
| Which SKUs are we paying for but not fully using, ranked by wasted seats? | microsoft-graph | microsoft-graph-cli licenses waste --agent |
| Is our open-ticket backlog up or down versus last week? | mspbots | mspbots-cli trend open_tickets --agg count |
| What's red right now, grouped by customer and ranked by severity? | n-central | n-central-cli triage --by customer |
| Which host pools have autoscale off or drifting across every customer? | nerdio | nerdio-cli fleet autoscale-audit |
| Which organizations are below 95% patch compliance? | ninjaone | ninjaone-cli patch-compliance --min-pct 95 |
| What's on fire right now, ranked by SLA risk? | pagerduty | pagerduty-cli pulse |
| Which documents were sent but never completed? | pandadoc | pandadoc-cli stalled --days 14 |
| Where is my billing leaking - invoiced for a cancelled product, or active but never billed? | pax8 | pax8-cli reconcile |
| Which open deals has nobody touched in two weeks, worst dollar value first? | pipedrive | pipedrive-cli stale --quiet-days 14 --agent |
| What malicious clicks and messages got through overnight? | proofpoint | proofpoint-cli backfill --since 12h |
| Which client VMs lack a good, recent backup (verified, where it is on PBS)? | proxmox | proxmox-cli posture --only problems --agent |
| Who owes us money, bucketed 0-30 / 31-60 / 61-90 / 90+? | quickbooks | quickbooks-cli ar-aging --agent |
| Where does the Acme quote stand? | quotewerks | quotewerks-cli docs search --customer "Acme" --type QUOTE |
| Who is overbooked across the whole fleet this month? | resourceguru | resourceguru-cli overbooked --start 2026-06-01 --end 2026-06-30 --agent |
| Is automation healthy for this client right now? | rewst | rewst-cli health --org <orgId> --since 24h --agent |
| Back up everything in a studio to disk? | riverside-fm | riverside-fm-cli bulk export --studio my-studio --out ./archive |
| What broke across all my clients overnight? | rocketcyber | rocketcyber-cli triage --since 24h |
| Who's on call right now across every service and schedule? | rootly | rootly-cli oncall-now |
| Which of our assets are most exposed right now? | runzero | runzero-cli triage --agent |
| What fired across every customer in the last 24 hours, critical first? | saas-alerts | saas-alerts-cli triage --since 24h --min-severity medium |
| Which sent or approved quotes are aging, and how much is at risk? | salesbuildr | salesbuildr-cli quote stale --days 14 |
| What should I triage first across all my client sites right now? | sentinelone | sentinelone-cli threats triage |
| Where is my attention needed today, ranked worst-first? | servosity | servosity-cli attention --top 5 |
| What is my net margin per customer this month - receivable minus payable? | sherweb | sherweb-cli margin --month 2026-04 |
| Which customers have a protection gap right now? | skykick | skykick-cli fleet-health --flag-gaps --agent |
| Give me one insurance-posture row per client firewall: firmware, end of support, advisories, licences, admin TOTP and SSL-VPN exposure. | sonicwall | sonicwall-cli posture |
| What needs attention across all my customers today? | sophos-central | sophos-central-cli fleet triage |
| Who's about to breach SLA, grouped by technician? | superops | superops-cli sla-watch --by tech --window 4h |
| Which customers have logged time we never invoiced? | syncro | syncro-cli billing uninvoiced |
| What's the overall health of my fleet right now? | tactical-rmm | tactical-rmm-cli fleet health |
| Which subscriptions renew in the next 30 days with auto-renew switched off? | td-synnex | td-synnex-cli subscriptions renewals --within 30d --auto-renew off |
| Which endpoints haven't checked in for 24 hours, across every site? | threatdown | threatdown-cli fleet stale --hours 24 --agent |
| What application approvals are pending across all my clients right now? | threatlocker | threatlocker-cli approvals triage --all-tenants |
| What changed in this site's config since my last check? | unifi-network | unifi-network-cli drift --site default --json |
| Which backup jobs are failing across all my customers? | veeam | veeam-cli fleet-health --agent |
| Which customer needs attention first across Firebox, endpoints, ThreatSync and licenses? | watchguard | watchguard-cli accounts health --agent |
| Publish a landing page from HTML without opening wp-admin? | wordpress | wordpress-cli pages create --title "Spring Promo" --content "<h1>Spring Promo</h1>" --status publish |
| Who owes us, and how overdue is each invoice? | xero | xero-cli aging --agent |
| Who on the team is overloaded, and who is idle? | zammad | zammad-cli agent-load --json |