lc-ai

Author and deploy LimaCharlie "apps" — self-contained AI-generated HTML mini-apps that render in a sandboxed iframe in the LimaCharlie web UI and call LimaCharlie APIs through a brokered, permission-scoped runtime (window.lc). Use when a user wants to create, edit, or understand a custom app/dashboard/tool embedded in the LimaCharlie console (the `app` hive).

Working with Detection & Response rules in LimaCharlie — AI-assisted generation, validation, unit testing, historical replay, deployment, FP rules, stateful rules, behavioral detection patterns, suppression, alternate detection targets, and response actions. Use when creating, testing, modifying, or managing D&R rules, false positive rules, or understanding detection patterns.

Complete adapter lifecycle assistant for LimaCharlie. Supports External Adapters (cloud-managed), Cloud Sensors (SaaS/cloud integrations), and On-prem USP adapters. Dynamically researches adapter types from local docs and GitHub usp-adapters repo. Creates, validates, deploys, and troubleshoots adapter configurations. Handles parsing rules (Grok, regex), field mappings, credential setup, and multi-adapter configs. Use when setting up new data sources (Okta, S3, Azure Event Hub, syslog, webhook, etc.), troubleshooting ingestion issues, or managing adapter deployments.

Working with LimaCharlie adapters — cloud sensors (SaaS integrations), external adapters (cloud-managed), and on-prem/USP adapters. Covers configuration, credential setup, parsing rules, validation, deployment, and troubleshooting. Use when setting up data sources, configuring adapters, or troubleshooting ingestion.

Set up automated Slack notifications for LimaCharlie case events. Creates a Python playbook, D&R rules, API key, and secrets so that case creations, resolutions, severity upgrades, and closures post rich messages to a Slack channel. Usage - /init-cases-to-slack <org_name>

REQUIRED for ANY operation involving ai-team or ai-agent definitions: deploy, install, update, upgrade, remove, push, sync, or modify AI agents and Agentic SOC configurations in a LimaCharlie organization. This includes modifying agent prompts, updating hive configs (ai_agent, dr-general), managing API keys and secrets, subscribing to extensions, and pushing changes after editing source YAML files in ai-teams/ or ai-agents/ directories. Trigger words: ai-team, ai-agent, ai_agent hive, deploy SOC, install agent, push agent, update agent, sync agent, baselining-soc, tiered-soc, lean-soc, exposure-team, intel-team, l1-bot, general-analyst, bulk-triage, l2-analyst, malware-analyst, containment, threat-hunter, soc-manager, shift-reporter. Examples: "deploy tiered-soc to my org", "install lean-soc", "update the l1-bot agent", "push agent changes to the org", "remove the tiered SOC", "modify the bulk-triage prompt".

Guided deployment of a compliance framework's case-reviewer agent (and optionally a starter rule subset) to a LimaCharlie org. Walks through LC API-key creation with scoped permissions, Anthropic secret staging, agent hive record sync, and trigger D&R rule installation. Use when the user asks to deploy, install, or set up compliance for PCI, HIPAA, CMMC, NIST 800-53, SOC 2, ISO 27001, or CIS v8 in a given org. Examples - "deploy PCI compliance to org XYZ", "install the HIPAA compliance agent", "set up CMMC compliance on my test org".

Comprehensive Asset Inventory & Coverage Tracker for LimaCharlie. Builds sensor inventories, detects coverage gaps (stale/silent endpoints, Shadow IT), calculates risk scores, validates telemetry health, and compares actual vs expected assets. Use for fleet inventory, coverage SLA tracking, offline sensor detection, telemetry health checks, asset compliance audits, or when asked about endpoint health, asset management, or coverage gaps.

Deploy the FULL recommended rule baseline for a compliance framework to a LimaCharlie org — every D&R rule, FIM rule, artifact-collection rule, and exfil rule defined in the framework's implementation doc. Defaults to dry-run; --apply is required to actually write. Idempotent; rules already deployed under the same name are skipped. Use when a customer has just installed lc-compliance and wants a framework's rules in their org for the first time, or wants to refresh the baseline after the implementation doc has been updated. Examples - "deploy the full PCI baseline to org XYZ", "install all CMMC rules", "push the HIPAA recommended set", "apply the CIS v8 baseline". Distinct from compliance-deploy, which deploys only the case-reviewer agent (and optionally a small starter rule subset for demos).

Run an ad-hoc compliance gap analysis against a live LimaCharlie org — compares what the org is currently collecting and detecting against the framework's recommended rule set, and returns a markdown punch list directly in chat (no case is created, no deployment needed). This is the primary way to run a gap analysis — there is no backend agent counterpart. Use for day-to-day engineering sanity checks and pre-audit reviews against CMMC, NIST 800-53, PCI DSS, HIPAA, SOC 2, ISO 27001, or CIS v8. Examples - "show me my PCI gaps", "run a HIPAA gap analysis on org XYZ", "what CIS safeguards am I missing?"

Working with LimaCharlie platform configuration — Hive (generic config store), outputs, extensions, lookups, secrets, YARA rules, API keys, and permissions. The admin toolbox for platform configuration. Use when managing outputs, extensions, lookups, secrets, API keys, or any Hive-based configuration.

Deploy and manage a daily AI agent that automatically updates GitHub documentation for a LimaCharlie organization. The agent collects org config, diffs against previous state, analyzes changes with full case/session context, renders Jinja2 templates, and pushes annotated updates to a GitHub repo. Templates are read from the lc-ai repo or a user-provided custom repo — no payloads needed. Use for "deploy doc updater", "set up automatic documentation", "install doc-updater agent", "update docs agent".

Generate comprehensive architecture and operations documentation for one or more LimaCharlie organizations. Accepts org names or OIDs. Produces markdown files covering sensors, D&R rules, AI agents, extensions, outputs, cloud adapters, access control, and operational runbooks. Includes Mermaid diagrams, GitHub callouts, collapsible sections, and verified LC docs links. Use for "document this org", "document all my orgs", "create architecture docs", "generate a wiki", "org inventory".

Look up how LimaCharlie covers a specific compliance control across any of seven frameworks (CMMC, NIST 800-53, PCI DSS, HIPAA, SOC 2, ISO 27001, CIS v8). Returns the relevant section from the framework's mapping and implementation docs plus the exact D&R rules that carry the control citation in their metadata. Use when the user asks things like "how does LC cover PCI 10.2.1.4?", "show me our NIST AU-2 coverage", "what rules map to CIS Safeguard 8.2?", "HIPAA §164.312(b) coverage".

Investigate security cases from the LimaCharlie Cases extension. Performs HOLISTIC investigations - not just process trees, but initial access hunting, org-wide scope assessment, lateral movement detection, and full host context. Enriches cases with telemetry references, entities/IOCs, analyst notes, and investigation summary/conclusion. Use for SOC triage, incident investigation, threat hunting, alert triage, or building SOC working reports. Supports case lifecycle management (triage, classify, resolve).

Working with LimaCharlie Cases — CRUD, lifecycle management, entities, telemetry references, notes, tags, merging, export, and bulk operations. Use when managing cases, adding evidence, updating case status, or querying the case queue.

Managing which events EDR sensors send to LimaCharlie — event collection rules, watch rules, performance rules, throughput management, Afterburner mode, and IR mode. Use when configuring which events sensors collect, troubleshooting throughput issues, managing high-volume sensors, or understanding why events are missing.

File and Registry Integrity Monitoring (FIM/RIM) in LimaCharlie — the Integrity extension for monitoring file system and registry changes with pattern-based rules. Covers rule patterns, platform-specific syntax, FIM_HIT events, Linux eBPF vs inotify limitations, and CLI management. Use when setting up integrity monitoring, writing FIM patterns, or troubleshooting FIM_HIT events.

LimaCharlie Infrastructure as Code — ext-git-sync repository structure, sync push/pull, global vs tenant-specific configs, importing and promoting rules across tenants. Use when managing multi-tenant configurations via git, setting up ext-git-sync, or syncing org configs.

Understanding LimaCharlie output stream structures — the four data streams (event, detect, audit, deployment) have different schemas, fields, and use cases. Covers stream structures, detection fields, audit log format, deployment events, filtering, and configuration. Use when configuring outputs, parsing LimaCharlie data in external systems, or understanding detection/audit/deployment stream formats.

Querying data in LimaCharlie — LCQL generation, validation, execution, cost estimation, saved queries, detection listing, and event schema exploration. Use when searching telemetry, analyzing detections, exploring event types, or running LCQL queries.

Sending commands to EDR sensors for live response, data collection, and incident response. Covers direct tasking (online sensors), reliable tasking (offline/guaranteed delivery), response collection, and payload deployment. Use when tasking sensors, collecting data, or deploying payloads fleet-wide.

Working with LimaCharlie sensors — listing, filtering, info, tags, installation keys, and sensor selectors. Covers both EDR agents and adapter sensors at the inventory level. Use when managing sensor inventory, checking sensor status, working with tags, creating installation keys, or building sensor selectors.

Set up interactive feedback channels for LimaCharlie ext-feedback. Subscribes to the extension, configures channels (Web, Slack, Telegram, Microsoft Teams, Email), creates required Tailored Outputs and secrets, and optionally creates a sample D&R rule that requests human approval before containment. Usage - /init-feedback <org_name>

Expert Detection Engineer assistant for creating and testing D&R rules in LimaCharlie. Guides through understanding threats, researching event data (Schema, LCQL, Timeline), generating detection logic, testing rules against sample and historical data, and deploying validated rules. Use for building detections, writing D&R rules, testing detection logic, or when user wants to detect specific behaviors or threats.

Send interactive feedback requests to humans via ext-feedback channels. Request approvals (approve/deny), acknowledgements, or free-form text answers through Slack, Telegram, Teams, Email, or built-in Web UI. Responses go to a case (note), playbook (trigger), or ai_agent (starts AI session). Use for human-in-the-loop approval, operator notifications, collecting analyst input, gating containment actions, or asking questions during investigations.

Generate URLs for the LimaCharlie web application interface. Quickly open the web UI for any feature: dashboard, sensors, detections, D&R rules, FP rules, secrets, outputs, lookups, payloads, YARA rules, artifacts, investigations, extensions, adapters, installation keys, billing, users, playbooks, AI agents, and more. For sensor-specific pages: timeline, console, processes, network, file-system, live-feed. For groups: members, organizations, permissions. Use for "open dashboard", "link to detections", "web UI for sensor", "open D&R rules page", "browser link", "app link", "open in web", "show me URL for", "go to".

Generate interactive HTML dashboards and visualizations from LimaCharlie data using Jinja2 templates and D3.js charts. Creates professional, self-contained HTML reports with pie charts, bar charts, line graphs, gauges, sortable tables, and responsive layouts. Supports MSSP multi-tenant dashboards, single-org details, sensor health reports, detection analytics, and billing summaries. Integrates with reporting, sensor-health, and detection-engineering skills. Built with strict data accuracy guardrails - NEVER fabricates, estimates, or infers data. Use for "visual report", "dashboard", "HTML output", "interactive charts", "export HTML", "generate visualization", "graphical report".

Deploy a temporary LimaCharlie Adapter on the local Linux or Mac OS host for testing log ingestion. Downloads the adapter, auto-detects log sources, and streams them to your LimaCharlie organization.

Deploy a temporary LimaCharlie EDR agent on the local Linux or Mac OS host for testing. Downloads and runs the LC sensor in a temp directory with automatic cleanup. Use for testing detection rules, investigating sensor behavior, or development. Requires selecting or creating a LimaCharlie organization first.

Automatically detect false positive patterns in detections using deterministic analysis. Fetches historic detections for a time window, runs pattern detection script to identify noisy patterns (single-host concentration, identical command-lines, service accounts, same hash, temporal periodicity, etc.), generates narrow FP rules for each pattern, and presents for user approval before deployment. Use for bulk FP tuning, detection noise analysis, or automated alert fatigue reduction.

Manage LimaCharlie Infrastructure as Code using ext-git-sync compatible repository structure. Initialize IaC repos, add/remove tenants, manage global and tenant-specific configurations (D&R rules, outputs, FIM, extensions, etc.), and coordinate with ext-git-sync for deployment. Supports importing existing rules from tenants and promoting tenant rules to global. Use when setting up multi-tenant config management, adding orgs to IaC, or managing detection rules across organizations via git.

Complete organization onboarding wizard for LimaCharlie. Discovers local cloud CLIs (GCP, AWS, Azure, DigitalOcean), surveys cloud projects, identifies VMs for EDR installation and security-relevant log sources (IAM, audit logs, network logs). Guides EDR deployment via OS Config (GCP), SSM (AWS), VM Run Command (Azure). Creates cloud adapters for log ingestion. Confirms sensor connectivity and data flow. Use when setting up new tenants, connecting cloud infrastructure, deploying EDR fleet-wide, or onboarding hybrid environments.

Customize and test Grok parsing for USP, Cloud Sensor, and External adapters. Helps generate parsing rules from sample logs, validate against test data, and deploy configurations. Use when setting up new log sources, troubleshooting parsing issues, or modifying field extraction for adapters.

Generate comprehensive multi-tenant security and operational reports from LimaCharlie. Provides billing summaries, usage roll-ups, detection trends, sensor health monitoring, and configuration audits across multiple organizations. Supports both per-tenant detailed breakdowns and cross-tenant aggregated roll-ups. Built with strict data accuracy guardrails to prevent fabricated metrics. Supports partial report generation when some organizations fail, with transparent error documentation. Time windows always displayed, detection limits clearly flagged, zero cost calculations.

Evaluate threat reports, breach analyses, and IOC reports to search for compromise indicators across LimaCharlie organizations. Extract IOCs (hashes, domains, IPs, file paths), perform IOC searches, identify malicious behaviors, generate LCQL queries, create D&R rules and lookups. Use when investigating threats, APT reports, malware analysis, breach postmortems, or threat intelligence feeds. Emphasizes working ONLY with data from the report and organization, never making assumptions.

Investigate noisy/common alerts and create false positive (FP) rules to suppress benign detections. Analyzes detection frequency over 7 days, identifies patterns, generates and tests FP rules with operator approval before deployment. Use for tuning detection noise, reducing alert fatigue, suppressing known-safe activity, or when specific detections need filtering. Human-in-the-loop workflow ensures no FP rules are deployed without explicit approval.

Deploy payloads and shell commands fleet-wide using reliable tasking. Execute scripts, collect data, or run commands across all endpoints with automatic handling of offline sensors. Use for vulnerability scanning, data collection, software inventory, compliance checks, or any fleet-wide operation.

Generate comprehensive sensor health and status reports across all LimaCharlie organizations. Use when users ask about sensor connectivity, data availability, offline sensors, sensors not reporting events, or fleet-wide health queries (e.g., "show me sensors online but not sending data", "list sensors offline for 7 days across all orgs").

Send tasks (commands) to EDR sensors to gather data or take action. Handles offline agents via reliable-tasking, collects responses via LCQL queries, and creates D&R rules for automated response handling. Use for live response, data collection, forensic acquisition, or fleet-wide operations like "get OS version from all Windows servers" or "isolate all hosts with tag X".