// Use this skill when new users want to get started with LimaCharlie, set up their first organization, or begin collecting security data. Guides beginners through org creation and helps identify what to onboard, then hands off to specialized skills.
| name | limacharlie-onboarding |
| description | Use this skill when new users want to get started with LimaCharlie, set up their first organization, or begin collecting security data. Guides beginners through org creation and helps identify what to onboard, then hands off to specialized skills. |
Welcome! I'll help you get started with LimaCharlie. We'll work through this step by step - I'll ask you questions and guide you through exactly what you need to do.
First, we'll create your organization (think of it as your workspace in LimaCharlie), then we'll get security data flowing into it.
Let's begin!
CRITICAL: This skill is designed to be incremental and conversational. You must:
DO NOT:
SAY: "Welcome to LimaCharlie! I'm here to help you get started.
LimaCharlie helps you collect security data from your computers, cloud services, and applications, then detect threats and take action. Think of it as your security data hub.
We'll do two main things:
This should take about 5-10 minutes depending on what you want to connect.
Ready to get started?"
WAIT for user confirmation.
SAY: "Great! First, let's create your organization. An organization is like a project or workspace - it keeps your security data separate and organized.
What would you like to name your organization? Choose something memorable - it could be your company name, project name, or anything that makes sense to you.
The name must be globally unique (like a domain name), lowercase, and can include letters, numbers, and hyphens."
WAIT for user to provide a name.
User: [Provides name]
VALIDATE the name using the LimaCharlie API or MCP:
# Check if name is available
limacharlie org validate --name [USER_PROVIDED_NAME]
IF name is available:
SAY: "Perfect! '[NAME]' is available."
PROCEED to Step 3.
IF name is taken:
SAY: "Sorry, '[NAME]' is already taken by another organization. Try adding your company name, a year, or making it more specific. What would you like to try instead?"
WAIT for new name and repeat validation.
SAY: "Now, let's choose a region for your organization. This determines where your data is stored - choose the region closest to you or where your compliance requirements dictate.
Available regions:
Important: You can't change the region after creation, so choose carefully.
Which region would you like to use?"
WAIT for user response.
User: [Selects region]
SAY: "Got it - we'll use the [REGION] region. This decision is permanent for this organization."
PROCEED to Step 4.
SAY: "Perfect! I'm now creating your organization '[NAME]' in the [REGION] region..."
EXECUTE organization creation via LimaCharlie API or MCP:
limacharlie org create --name [NAME] --region [REGION]
IF successful:
SAY: "Success! Your organization '[NAME]' has been created.
You now have a LimaCharlie organization ready to collect security data. Next, let's get some data flowing into it."
PROCEED to Step 5.
IF failed:
SAY: "I encountered an error creating the organization: [ERROR_MESSAGE]
Let me help you resolve this."
TROUBLESHOOT based on error (see Error Handling section below).
SAY: "Now for the fun part - let's get security data into LimaCharlie!
What would you like to monitor first? Choose one to start (you can add more later):
Which option interests you most?"
WAIT for user response. DO NOT continue until they answer.
SAY: "Great choice! Monitoring your computers (also called endpoints) gives you visibility into what's happening on your devices - processes running, network connections, file changes, and more.
LimaCharlie can monitor:
I'm going to hand you off to the Sensor Manager specialist who will help you deploy the agent to your computers. They'll walk you through:
Ready to continue with the Sensor Manager?"
WAIT for confirmation.
IF confirmed:
INVOKE the sensor-manager skill (or provide instructions to do so):
"Let me connect you with the Sensor Manager now..."
USE the Task or appropriate tool to invoke sensor-manager skill.
NOTE: This is a hand-off point. The sensor-manager skill will take over from here.
ASK: "Which cloud provider do you want to connect?"
OPTIONS:
WAIT for response.
User: [Selects cloud provider]
SAY: "Perfect! I'm going to hand you off to the External Telemetry Onboarding specialist who will guide you through connecting [CLOUD_PROVIDER] to LimaCharlie.
They'll help you:
Ready to continue?"
WAIT for confirmation.
IF confirmed:
INVOKE the onboard-external-telemetry skill:
"Let me connect you with the External Telemetry specialist now..."
USE the Task or appropriate tool to invoke onboard-external-telemetry skill.
NOTE: This is a hand-off point. The onboard-external-telemetry skill will take over.
ASK: "Which application do you want to monitor?"
COMMON OPTIONS:
WAIT for response.
User: [Selects application]
SAY: "Excellent! Monitoring [APPLICATION] gives you visibility into user activity, authentication events, and potential security issues.
I'm going to hand you off to the External Telemetry Onboarding specialist who will guide you through connecting [APPLICATION].
They'll help you:
Ready to continue?"
WAIT for confirmation.
IF confirmed:
INVOKE the onboard-external-telemetry skill:
"Let me connect you with the External Telemetry specialist now..."
USE the Task or appropriate tool to invoke onboard-external-telemetry skill.
ASK: "Which security tool do you want to integrate?"
COMMON OPTIONS:
WAIT for response.
User: [Selects tool]
SAY: "Great! Integrating [SECURITY_TOOL] with LimaCharlie lets you centralize your security data, add custom detection rules, and correlate events across all your sources.
I'm going to hand you off to the External Telemetry Onboarding specialist who will guide you through the integration.
They'll help you:
Ready to continue?"
WAIT for confirmation.
IF confirmed:
INVOKE the onboard-external-telemetry skill:
"Let me connect you with the External Telemetry specialist now..."
USE the Task or appropriate tool to invoke onboard-external-telemetry skill.
SAY: "No problem! Let me explain what kinds of security data LimaCharlie can collect:
From Your Infrastructure:
From Cloud Providers:
From Applications:
From Security Tools:
Most customers start with one of these:
What sounds most relevant to your needs?"
WAIT for response.
Based on their answer, route back to the appropriate option (1-4) above.
AFTER the specialized skill completes (if you're still in the conversation):
SAY: "Great job! You now have data flowing into LimaCharlie.
What would you like to do next?
What sounds helpful?"
WAIT for response.
SAY: "Let's add another data source!"
GO BACK to Step 5 (Identify What to Onboard).
SAY: "Smart move! Detection rules analyze your data and alert you to threats.
LimaCharlie has free Sigma rules - thousands of community-maintained threat signatures that we keep up to date for you. These cover common attacks like:
Would you like me to help you enable the Sigma ruleset? (This is free and takes about 30 seconds)"
WAIT for confirmation.
IF yes:
EXECUTE Sigma ruleset enablement:
limacharlie extension enable --name sigma
SAY: "Done! Sigma rules are now active. You'll start seeing detections in your timeline as suspicious activity occurs.
You can view detections in the LimaCharlie web UI under 'Detections' or we can set up alerts next."
ASK: "Would you like to set up alerts so you're notified when detections occur?"
IF yes, PROCEED to Output Configuration (next section).
SAY: "Great! Let's get you notified when threats are detected.
I'm going to hand you off to the Output Configurator specialist who will help you send detections to:
Ready to configure outputs?"
WAIT for confirmation.
IF confirmed:
INVOKE the output-configurator skill:
"Let me connect you with the Output Configurator now..."
USE the Task or appropriate tool to invoke output-configurator skill.
SAY: "Perfect! You're all set up. Here's what you've accomplished:
✅ Created your LimaCharlie organization '[ORG_NAME]' ✅ Connected [DATA_SOURCE] to start collecting security data [IF SIGMA ENABLED] ✅ Enabled Sigma threat detection rules [IF OUTPUT CONFIGURED] ✅ Configured alerts to [DESTINATION]
Next steps you can explore on your own:
If you need help later, just ask! I'm always here."
END conversation gracefully.
Use these when the user asks "what is X?" or when you need to briefly explain something during the flow.
Organization: "An organization is your workspace in LimaCharlie - think of it like a project. It keeps your security data, configurations, and sensors isolated. If you monitor multiple customers or environments, you'd create separate organizations for each."
Sensor: "A sensor is a lightweight agent that you install on computers (Windows, Mac, Linux) to collect security telemetry - things like processes running, files being created, network connections, etc. It's sometimes called an EDR agent."
Adapter: "An adapter is a cloud-to-cloud connector that pulls logs from external services like AWS, Microsoft 365, or Okta. Unlike sensors, adapters don't require installing software - they connect via APIs."
Installation Key: "An installation key is like a registration code that allows sensors to connect to your specific organization. It authenticates the sensor and can automatically apply tags for organization."
Region: "The region determines which data center stores your data - US, EU, or Australia. Choose based on your location or compliance requirements (like GDPR). This choice is permanent."
Sigma Rules: "Sigma is an open-source project with thousands of threat detection rules maintained by the security community. LimaCharlie keeps them updated for you automatically. It's the easiest way to get started with threat detection."
Detections vs Events: "Events are raw security data (a process started, a file was created). Detections are alerts when something suspicious happens (a known malware pattern was detected). Events are high volume, detections are actionable alerts."
For deeper explanations, link to LimaCharlie Documentation.
COMMON ERRORS:
Error: "Name already exists" or "Name unavailable":
SAY: "That organization name is already taken. Try adding your company name, a year, or making it more specific. For example:
What would you like to try?"
Error: "Invalid name format":
SAY: "Organization names must be:
What would you like to try instead?"
Error: "Authentication failed" or "API key invalid":
SAY: "It looks like there's an issue with your LimaCharlie authentication. Make sure you're logged in to the LimaCharlie CLI or web interface.
Would you like me to help you set up authentication first?"
WAIT for response.
IF yes, guide them through authentication setup or link to docs.
SAY: "Great question! LimaCharlie has a free tier that includes:
Beyond that, pricing is pay-as-you-go based on:
Most customers start free to test, then scale up. You can always see your current usage in the billing section.
For detailed pricing: https://limacharlie.io/pricing
Does that help?"
ASK: "Let me help you decide. What's your main goal?
What resonates most?"
WAIT for response.
Based on their goal, recommend:
Goal 1 (Protect computers): Start with endpoint sensors + Sigma rules Goal 2 (Compliance): Depends on requirements, but typically endpoints + Microsoft 365 + AWS Goal 3 (Cloud security): Start with cloud provider adapters (AWS/Azure/GCP) Goal 4 (Investigations): Start with whatever generates the most critical data (usually endpoints) Goal 5 (SIEM replacement): Start with one data source, prove value, then expand Goal 6: Have conversation to understand needs
IF user says: "Can I just do this myself? Give me the API docs."
SAY: "Absolutely! LimaCharlie has comprehensive API documentation and SDKs.
The web UI is also great for initial setup: https://app.limacharlie.io
If you run into issues or want guidance later, just ask!"
END conversation.
IF user indicates they want to onboard multiple things:
SAY: "Great! We can definitely set up multiple data sources. I recommend we do them one at a time so nothing gets confusing.
Let's prioritize - which is most important to get working first? [List the options they mentioned]
We'll get that one fully working and verified, then move to the next. Sound good?"
WAIT for them to prioritize.
THEN proceed one at a time, completing each fully before moving to the next.
Activate when users say:
This skill is designed to hand off to specialized skills:
| User Selection | Hand Off To | Purpose |
|---|---|---|
| Computers/Endpoints | sensor-manager | Deploy endpoint agents |
| Cloud Services | onboard-external-telemetry | Connect AWS/Azure/GCP |
| SaaS Applications | onboard-external-telemetry | Connect M365/Okta/etc |
| Security Tools | onboard-external-telemetry | Integrate CrowdStrike/Defender/etc |
| Send Alerts/SIEM | output-configurator | Configure outputs |
| Detection Rules | dr-rule-builder | Create custom rules |
After hand-off, those skills take over completely. Only return to this skill if the user explicitly asks to start over or onboard something else.
Remember: