Manage LimaCharlie Infrastructure as Code using ext-git-sync compatible repository structure.
Initialize IaC repos, add/remove tenants, manage global and tenant-specific configurations
(D&R rules, outputs, FIM, extensions, etc.), and coordinate with ext-git-sync for deployment.
Supports importing existing rules from tenants and promoting tenant rules to global.
Use when setting up multi-tenant config management, adding orgs to IaC, or managing
detection rules across organizations via git.
Manage LimaCharlie Infrastructure as Code using ext-git-sync compatible repository structure.
Initialize IaC repos, add/remove tenants, manage global and tenant-specific configurations
(D&R rules, outputs, FIM, extensions, etc.), and coordinate with ext-git-sync for deployment.
Supports importing existing rules from tenants and promoting tenant rules to global.
Use when setting up multi-tenant config management, adding orgs to IaC, or managing
detection rules across organizations via git.
Initialize global config files with version: 3 headers
Create empty org-manifest.yaml
Initialize git repository
Provide instructions for ext-git-sync setup
Add Existing Tenant
"Add tenant acme-corp" or "Add org Acme Corporation to IaC"
Adds an existing LimaCharlie organization to the repository:
Workflow:
Look up organization by name using limacharlie org list --output yaml
Confirm with user if multiple matches
Create orgs/<oid>/index.yaml with global includes
Create orgs/<oid>/custom/ directory for future customizations
Add entry to org-manifest.yaml
Optionally: Export current config from LC using ext-git-sync or limacharlie sync pull
Commit changes
Example index.yaml generated:
version:3include:# Global configurations-../../hives/extensions.yaml-../../hives/dr-general.yaml-../../hives/fp.yaml-../../hives/outputs.yaml-../../hives/integrity.yaml-../../hives/artifact.yaml-../../hives/exfil.yaml-../../hives/resources.yaml-../../hives/installation_keys.yaml# Custom configurations for this org (uncomment as needed)# - custom/rules.yaml# - custom/fim.yaml# - custom/outputs.yaml
Create New Organization
"Create new org called acme-corp" or "Create tenant Acme Corporation in US region"
Creates a new organization in LimaCharlie AND adds it to the repository:
Workflow:
Use create_org to create organization in LC
Follow "Add Existing Tenant" workflow
Provide installation key information
Remove Tenant from IaC
"Remove acme-corp from IaC" (does NOT delete the org in LC)
Workflow:
Look up OID from org-manifest.yaml
Remove orgs/<oid>/ directory
Remove entry from org-manifest.yaml
Commit changes
Rule Management
Add Global Rule (New)
"Add detection for encoded PowerShell to all tenants""Create global rule to detect mimikatz"
Creates a NEW rule and adds it to global config:
Workflow:
Use AI generation (limacharlie ai generate-detection, limacharlie ai generate-response)
Validate with limacharlie dr validate
Append to hives/dr-general.yaml
Commit with descriptive message
Import Rule from Tenant
"Import rule encoded-powershell from acme-corp""Get rule mimikatz-detection from globex into IaC"
Fetches an EXISTING rule from a LimaCharlie tenant and adds it to the IaC repo:
Workflow:
Look up tenant OID from org-manifest.yaml
Fetch rule using the CLI:
limacharlie dr get --key encoded-powershell --oid <tenant-oid> --output yaml
Ask user: Add as global (all tenants) or tenant-specific?
If global: Add to hives/dr-general.yaml
If tenant-specific: Add to orgs/<oid>/custom/rules.yaml
Commit changes
Promote Rule to Global
"Promote rule encoded-powershell from acme-corp to global""Make rule X from globex apply to all tenants"
Takes an existing rule from ONE tenant and makes it apply to ALL tenants:
Workflow:
Look up source tenant OID from org-manifest.yaml
Fetch rule using limacharlie dr get --key <name> --oid <oid> --output yaml
Add rule to hives/dr-general.yaml
Ask user: Remove from tenant's custom config? (if it was tenant-specific)
If yes: Remove from orgs/<oid>/custom/rules.yaml
Commit: "Promote rule [name] from [tenant] to global"
Example:
User: "Promote rule lateral-movement-psexec from acme-corp to global"
Skill:
1. Fetches rule from acme-corp (OID: 7e41e07b-...)
2. Adds to hives/dr-general.yaml:
hives:
dr-general:
lateral-movement-psexec:
data:
detect: ...
respond: ...
usr_mtd:
enabled: true
3. All tenants now get this rule via their index.yaml includes
Copy Rule Between Tenants
"Copy rule X from acme-corp to globex""Give globex the same custom-detection rule that acme-corp has"
Copies a rule from one tenant to another (without making it global):
Workflow:
Look up source tenant OID
Fetch rule from source tenant
Look up destination tenant OID
Add to orgs/<dest-oid>/custom/rules.yaml
Update destination's index.yaml to include custom rules if needed
Commit changes
Add Tenant-Specific Rule
"Add custom detection only for acme-corp""Create rule for globex to detect their specific app"
Creates a NEW rule for ONE tenant only:
Workflow:
Look up tenant OID from org-manifest.yaml
Use AI generation for rule
Validate rule
Create/update orgs/<oid>/custom/rules.yaml
Update orgs/<oid>/index.yaml to include custom rules
Commit changes
List Rules
"Show all global rules""What rules does acme-corp have?""List custom rules for globex"
