Menü
SkillsMP hat 43 Skills aus refractionPOINT/lc-ai gesammelt. Öffne einen Skill, um Quelle und Details zu prüfen.
Es werden 40 von 43 gesammelten Skills angezeigt.
LimaCharlie Cloud Security (CNAPP) — cloud findings triage, security-graph pivoting and queries, attack paths, CIEM identity analysis, inventory, data security, CAASM, compliance, and MSSP fleet views. Use when investigating cloud risk, pivoting between cloud…
Quellsprache: Englisch
Author and deploy LimaCharlie "apps" — self-contained AI-generated HTML mini-apps that render in a sandboxed iframe in the LimaCharlie web UI and call LimaCharlie APIs through a brokered, permission-scoped runtime (window.lc). Use when a user wants to create,…
Quellsprache: Englisch
Working with Detection & Response rules in LimaCharlie — AI-assisted generation, validation, unit testing, historical replay, deployment, FP rules, stateful rules, behavioral detection patterns, suppression, alternate detection targets, and response actions.…
Quellsprache: Englisch
Complete adapter lifecycle assistant for LimaCharlie. Supports External Adapters (cloud-managed), Cloud Sensors (SaaS/cloud integrations), and On-prem USP adapters. Dynamically researches adapter types from local docs and GitHub usp-adapters repo. Creates,…
Quellsprache: Englisch
Working with LimaCharlie adapters — cloud sensors (SaaS integrations), external adapters (cloud-managed), and on-prem/USP adapters. Covers configuration, credential setup, parsing rules, validation, deployment, and troubleshooting. Use when setting up data…
Quellsprache: Englisch
Set up automated Slack notifications for LimaCharlie case events. Creates a Python playbook, D&R rules, API key, and secrets so that case creations, resolutions, severity upgrades, and closures post rich messages to a Slack channel. Usage -…
Quellsprache: Englisch
REQUIRED for ANY operation involving ai-team or ai-agent definitions: deploy, install, update, upgrade, remove, push, sync, or modify AI agents and Agentic SOC configurations in a LimaCharlie organization. This includes modifying agent prompts, updating hive…
Quellsprache: Englisch
Guided deployment of a compliance framework's case-reviewer agent (and optionally a starter rule subset) to a LimaCharlie org. Walks through LC API-key creation with scoped permissions, Anthropic secret staging, agent hive record sync, and trigger D&R rule…
Quellsprache: Englisch
Comprehensive Asset Inventory & Coverage Tracker for LimaCharlie. Builds sensor inventories, detects coverage gaps (stale/silent endpoints, Shadow IT), calculates risk scores, validates telemetry health, and compares actual vs expected assets. Use for fleet…
Quellsprache: Englisch
Deploy the FULL recommended rule baseline for a compliance framework to a LimaCharlie org — every D&R rule, FIM rule, artifact-collection rule, and exfil rule defined in the framework's implementation doc. Defaults to dry-run; --apply is required to actually…
Quellsprache: Englisch
Run an ad-hoc compliance gap analysis against a live LimaCharlie org — compares what the org is currently collecting and detecting against the framework's recommended rule set, and returns a markdown punch list directly in chat (no case is created, no…
Quellsprache: Englisch
Working with LimaCharlie platform configuration — Hive (generic config store), outputs, extensions, lookups, secrets, YARA rules, API keys, and permissions. The admin toolbox for platform configuration. Use when managing outputs, extensions, lookups, secrets,…
Quellsprache: Englisch
Deploy and manage a daily AI agent that automatically updates GitHub documentation for a LimaCharlie organization. The agent collects org config, diffs against previous state, analyzes changes with full case/session context, renders Jinja2 templates, and…
Quellsprache: Englisch
Generate comprehensive architecture and operations documentation for one or more LimaCharlie organizations. Accepts org names or OIDs. Produces markdown files covering sensors, D&R rules, AI agents, extensions, outputs, cloud adapters, access control, and…
Quellsprache: Englisch
Look up how LimaCharlie covers a specific compliance control across any of seven frameworks (CMMC, NIST 800-53, PCI DSS, HIPAA, SOC 2, ISO 27001, CIS v8). Returns the relevant section from the framework's mapping and implementation docs plus the exact D&R…
Quellsprache: Englisch
Investigate security cases from the LimaCharlie Cases extension. Performs HOLISTIC investigations - not just process trees, but initial access hunting, org-wide scope assessment, lateral movement detection, and full host context. Enriches cases with telemetry…
Quellsprache: Englisch
Working with LimaCharlie Cases — CRUD, lifecycle management, entities, telemetry references, notes, tags, merging, export, and bulk operations. Use when managing cases, adding evidence, updating case status, or querying the case queue.
Quellsprache: Englisch
Managing which events EDR sensors send to LimaCharlie — event collection rules, watch rules, performance rules, throughput management, Afterburner mode, and IR mode. Use when configuring which events sensors collect, troubleshooting throughput issues,…
Quellsprache: Englisch
File and Registry Integrity Monitoring (FIM/RIM) in LimaCharlie — the Integrity extension for monitoring file system and registry changes with pattern-based rules. Covers rule patterns, platform-specific syntax, FIM_HIT events, Linux eBPF vs inotify…
Quellsprache: Englisch
LimaCharlie Infrastructure as Code — ext-git-sync repository structure, sync push/pull, global vs tenant-specific configs, importing and promoting rules across tenants. Use when managing multi-tenant configurations via git, setting up ext-git-sync, or syncing…
Quellsprache: Englisch
Understanding LimaCharlie output stream structures — the four data streams (event, detect, audit, deployment) have different schemas, fields, and use cases. Covers stream structures, detection fields, audit log format, deployment events, filtering, and…
Quellsprache: Englisch
Querying data in LimaCharlie — LCQL generation, validation, execution, cost estimation, saved queries, detection listing, and event schema exploration. Use when searching telemetry, analyzing detections, exploring event types, or running LCQL queries.
Quellsprache: Englisch
Sending commands to EDR sensors for live response, data collection, and incident response. Covers direct tasking (online sensors), reliable tasking (offline/guaranteed delivery), response collection, and payload deployment. Use when tasking sensors,…
Quellsprache: Englisch
Working with LimaCharlie sensors — listing, filtering, info, tags, installation keys, and sensor selectors. Covers both EDR agents and adapter sensors at the inventory level. Use when managing sensor inventory, checking sensor status, working with tags,…
Quellsprache: Englisch
Set up interactive feedback channels for LimaCharlie ext-feedback. Subscribes to the extension, configures channels (Web, Slack, Telegram, Microsoft Teams, Email), creates required Tailored Outputs and secrets, and optionally creates a sample D&R rule that…
Quellsprache: Englisch
Expert Detection Engineer assistant for creating and testing D&R rules in LimaCharlie. Guides through understanding threats, researching event data (Schema, LCQL, Timeline), generating detection logic, testing rules against sample and historical data, and…
Quellsprache: Englisch
Send interactive feedback requests to humans via ext-feedback channels. Request approvals (approve/deny), acknowledgements, or free-form text answers through Slack, Telegram, Teams, Email, or built-in Web UI. Responses go to a case (note), playbook (trigger),…
Quellsprache: Englisch
Generate URLs for the LimaCharlie web application interface. Quickly open the web UI for any feature: dashboard, sensors, detections, D&R rules, FP rules, secrets, outputs, lookups, payloads, YARA rules, artifacts, investigations, extensions, adapters,…
Quellsprache: Englisch
Generate interactive HTML dashboards and visualizations from LimaCharlie data using Jinja2 templates and D3.js charts. Creates professional, self-contained HTML reports with pie charts, bar charts, line graphs, gauges, sortable tables, and responsive layouts.…
Quellsprache: Englisch
Deploy a temporary LimaCharlie Adapter on the local Linux or Mac OS host for testing log ingestion. Downloads the adapter, auto-detects log sources, and streams them to your LimaCharlie organization.
Quellsprache: Englisch
Deploy a temporary LimaCharlie EDR agent on the local Linux or Mac OS host for testing. Downloads and runs the LC sensor in a temp directory with automatic cleanup. Use for testing detection rules, investigating sensor behavior, or development. Requires…
Quellsprache: Englisch
Automatically detect false positive patterns in detections using deterministic analysis. Fetches historic detections for a time window, runs pattern detection script to identify noisy patterns (single-host concentration, identical command-lines, service…
Quellsprache: Englisch
Manage LimaCharlie Infrastructure as Code using ext-git-sync compatible repository structure. Initialize IaC repos, add/remove tenants, manage global and tenant-specific configurations (D&R rules, outputs, FIM, extensions, etc.), and coordinate with…
Quellsprache: Englisch
Complete organization onboarding wizard for LimaCharlie. Discovers local cloud CLIs (GCP, AWS, Azure, DigitalOcean), surveys cloud projects, identifies VMs for EDR installation and security-relevant log sources (IAM, audit logs, network logs). Guides EDR…
Quellsprache: Englisch
Customize and test Grok parsing for USP, Cloud Sensor, and External adapters. Helps generate parsing rules from sample logs, validate against test data, and deploy configurations. Use when setting up new log sources, troubleshooting parsing issues, or…
Quellsprache: Englisch
Generate comprehensive multi-tenant security and operational reports from LimaCharlie. Provides billing summaries, usage roll-ups, detection trends, sensor health monitoring, and configuration audits across multiple organizations. Supports both per-tenant…
Quellsprache: Englisch
Evaluate threat reports, breach analyses, and IOC reports to search for compromise indicators across LimaCharlie organizations. Extract IOCs (hashes, domains, IPs, file paths), perform IOC searches, identify malicious behaviors, generate LCQL queries, create…
Quellsprache: Englisch
Investigate noisy/common alerts and create false positive (FP) rules to suppress benign detections. Analyzes detection frequency over 7 days, identifies patterns, generates and tests FP rules with operator approval before deployment. Use for tuning detection…
Quellsprache: Englisch
Deploy payloads and shell commands fleet-wide using reliable tasking. Execute scripts, collect data, or run commands across all endpoints with automatic handling of offline sensors. Use for vulnerability scanning, data collection, software inventory,…
Quellsprache: Englisch
Generate comprehensive sensor health and status reports across all LimaCharlie organizations. Use when users ask about sensor connectivity, data availability, offline sensors, sensors not reporting events, or fleet-wide health queries (e.g., "show me sensors…
Quellsprache: Englisch