Author and deploy LimaCharlie "apps" — self-contained AI-generated HTML mini-apps that render in a sandboxed iframe in the LimaCharlie web UI and call LimaCharlie APIs through a brokered, permission-scoped runtime (window.lc). Use when a user wants to create, edit, or understand a custom app/dashboard/tool embedded in the LimaCharlie console (the `app` hive).
Working with Detection & Response rules in LimaCharlie — AI-assisted generation, validation, unit testing, historical replay, deployment, FP rules, stateful rules, behavioral detection patterns, suppression, alternate detection targets, and response actions. Use when creating, testing, modifying, or managing D&R rules, false positive rules, or understanding detection patterns.
Complete adapter lifecycle assistant for LimaCharlie. Supports External Adapters (cloud-managed), Cloud Sensors (SaaS/cloud integrations), and On-prem USP adapters. Dynamically researches adapter types from local docs and GitHub usp-adapters repo. Creates, validates, deploys, and troubleshoots adapter configurations. Handles parsing rules (Grok, regex), field mappings, credential setup, and multi-adapter configs. Use when setting up new data sources (Okta, S3, Azure Event Hub, syslog, webhook, etc.), troubleshooting ingestion issues, or managing adapter deployments.
Working with LimaCharlie adapters — cloud sensors (SaaS integrations), external adapters (cloud-managed), and on-prem/USP adapters. Covers configuration, credential setup, parsing rules, validation, deployment, and troubleshooting. Use when setting up data sources, configuring adapters, or troubleshooting ingestion.
Set up automated Slack notifications for LimaCharlie case events. Creates a Python playbook, D&R rules, API key, and secrets so that case creations, resolutions, severity upgrades, and closures post rich messages to a Slack channel. Usage - /init-cases-to-slack <org_name>
REQUIRED for ANY operation involving ai-team or ai-agent definitions: deploy, install, update, upgrade, remove, push, sync, or modify AI agents and Agentic SOC configurations in a LimaCharlie organization. This includes modifying agent prompts, updating hive configs (ai_agent, dr-general), managing API keys and secrets, subscribing to extensions, and pushing changes after editing source YAML files in ai-teams/ or ai-agents/ directories. Trigger words: ai-team, ai-agent, ai_agent hive, deploy SOC, install agent, push agent, update agent, sync agent, baselining-soc, tiered-soc, lean-soc, exposure-team, intel-team, l1-bot, general-analyst, bulk-triage, l2-analyst, malware-analyst, containment, threat-hunter, soc-manager, shift-reporter. Examples: "deploy tiered-soc to my org", "install lean-soc", "update the l1-bot agent", "push agent changes to the org", "remove the tiered SOC", "modify the bulk-triage prompt".
Guided deployment of a compliance framework's case-reviewer agent (and optionally a starter rule subset) to a LimaCharlie org. Walks through LC API-key creation with scoped permissions, Anthropic secret staging, agent hive record sync, and trigger D&R rule installation. Use when the user asks to deploy, install, or set up compliance for PCI, HIPAA, CMMC, NIST 800-53, SOC 2, ISO 27001, or CIS v8 in a given org. Examples - "deploy PCI compliance to org XYZ", "install the HIPAA compliance agent", "set up CMMC compliance on my test org".
Comprehensive Asset Inventory & Coverage Tracker for LimaCharlie. Builds sensor inventories, detects coverage gaps (stale/silent endpoints, Shadow IT), calculates risk scores, validates telemetry health, and compares actual vs expected assets. Use for fleet inventory, coverage SLA tracking, offline sensor detection, telemetry health checks, asset compliance audits, or when asked about endpoint health, asset management, or coverage gaps.