lc-advanced-skills

Plugin lc-advanced-skills from marketplace lc-marketplace in refractionPOINT/lc-ai. Commands read from the repo's manifest — 2 days ago.

Skills (16)

• adapter-assistant

  Complete adapter lifecycle assistant for LimaCharlie. Supports External Adapters (cloud-managed), Cloud Sensors (SaaS/cloud integrations), and On-prem USP adapters. Dynamically researches adapter types from local docs and GitHub usp-adapters repo. Creates, validates, deploys, and troubleshoots adapt

• doc-updater

  Deploy and manage a daily AI agent that automatically updates GitHub documentation for a LimaCharlie organization. The agent collects org config, diffs against previous state, analyzes changes with full case/session context, renders Jinja2 templates, and pushes annotated updates to a GitHub repo. Te

• fp-pattern-finder

  Automatically detect false positive patterns in detections using deterministic analysis. Fetches historic detections for a time window, runs pattern detection script to identify noisy patterns (single-host concentration, identical command-lines, service accounts, same hash, temporal periodicity, etc

• graphic-output

  Generate interactive HTML dashboards and visualizations from LimaCharlie data using Jinja2 templates and D3.js charts. Creates professional, self-contained HTML reports with pie charts, bar charts, line graphs, gauges, sortable tables, and responsive layouts. Supports MSSP multi-tenant dashboards, s

• init-cases-to-slack

  Set up automated Slack notifications for LimaCharlie case events. Creates a Python playbook, D&R rules, API key, and secrets so that case creations, resolutions, severity upgrades, and closures post rich messages to a Slack channel. Usage - /init-cases-to-slack <org_name>

• init-feedback

  Set up interactive feedback channels for LimaCharlie ext-feedback. Subscribes to the extension, configures channels (Web, Slack, Telegram, Microsoft Teams, Email), creates required Tailored Outputs and secrets, and optionally creates a sample D&R rule that requests human approval before containment.

• lc-deployer

  REQUIRED for ANY operation involving ai-team or ai-agent definitions: deploy, install, update, upgrade, remove, push, sync, or modify AI agents and Agentic SOC configurations in a LimaCharlie organization. This includes modifying agent prompts, updating hive configs (ai_agent, dr-general), managing

• limacharlie-iac

  Manage LimaCharlie Infrastructure as Code using ext-git-sync compatible repository structure. Initialize IaC repos, add/remove tenants, manage global and tenant-specific configurations (D&R rules, outputs, FIM, extensions, etc.), and coordinate with ext-git-sync for deployment. Supports importing ex

• onboard-new-org

  Complete organization onboarding wizard for LimaCharlie. Discovers local cloud CLIs (GCP, AWS, Azure, DigitalOcean), surveys cloud projects, identifies VMs for EDR installation and security-relevant log sources (IAM, audit logs, network logs). Guides EDR deployment via OS Config (GCP), SSM (AWS), VM

• org-documentation

  Generate comprehensive architecture and operations documentation for one or more LimaCharlie organizations. Accepts org names or OIDs. Produces markdown files covering sensors, D&R rules, AI agents, extensions, outputs, cloud adapters, access control, and operational runbooks. Includes Mermaid diagr

• parsing-helper

  Customize and test Grok parsing for USP, Cloud Sensor, and External adapters. Helps generate parsing rules from sample logs, validate against test data, and deploy configurations. Use when setting up new log sources, troubleshooting parsing issues, or modifying field extraction for adapters.

• reporting

  Generate comprehensive multi-tenant security and operational reports from LimaCharlie. Provides billing summaries, usage roll-ups, detection trends, sensor health monitoring, and configuration audits across multiple organizations. Supports both per-tenant detailed breakdowns and cross-tenant aggrega

• sensor-coverage

  Comprehensive Asset Inventory & Coverage Tracker for LimaCharlie. Builds sensor inventories, detects coverage gaps (stale/silent endpoints, Shadow IT), calculates risk scores, validates telemetry health, and compares actual vs expected assets. Use for fleet inventory, coverage SLA tracking, offline

• test-limacharlie-adapter

  Deploy a temporary LimaCharlie Adapter on the local Linux or Mac OS host for testing log ingestion. Downloads the adapter, auto-detects log sources, and streams them to your LimaCharlie organization.

• test-limacharlie-edr

  Deploy a temporary LimaCharlie EDR agent on the local Linux or Mac OS host for testing. Downloads and runs the LC sensor in a temp directory with automatic cleanup. Use for testing detection rules, investigating sensor behavior, or development. Requires selecting or creating a LimaCharlie organizati

• threat-report-evaluation

  Evaluate threat reports, breach analyses, and IOC reports to search for compromise indicators across LimaCharlie organizations. Extract IOCs (hashes, domains, IPs, file paths), perform IOC searches, identify malicious behaviors, generate LCQL queries, create D&R rules and lookups. Use when investiga

Slash commands (2)

• /lc-advanced-skills:add-new-skill

  Create a new skill for the lc-essentials plugin following best practices and framework conventions. Use when adding LimaCharlie API operations, orchestration workflows, or specialized capabilities to the plugin.

• /lc-advanced-skills:reporting-templates

  Pre-defined report templates combining data collection and visualization. Usage: /lc-essentials:reporting-templates

Subagents (16)

• adapter-doc-researcher

  Research adapter documentation from multiple sources in parallel. Gathers configuration parameters, examples, and credential requirements from local docs, GitHub usp-adapters repo, and external API documentation.

• asset-profiler

  Collect comprehensive asset profile for a SINGLE sensor. Designed to be spawned in parallel (batched) by the sensor-coverage skill. Gathers OS version, packages, users, services, autoruns, and network connections. Returns structured JSON profile.

• behavior-hunter

  Search for malicious behaviors within a SINGLE LimaCharlie organization using LCQL queries. Designed to be spawned in parallel (one instance per org) by the threat-report-evaluation skill. Returns summarized findings with sample events.

• cloud-discoverer

  Survey a single cloud platform (GCP, AWS, Azure, DigitalOcean) to discover projects, VMs, and security-relevant log sources. Designed to be spawned in parallel (one instance per platform) by the onboard-new-org skill. Returns structured JSON with discovered resources.

• detection-builder

  Generate and validate D&R rules for a specific detection layer within a SINGLE LimaCharlie organization. Designed to be spawned in parallel (one per layer) by the threat-report-evaluation skill. Returns validated rules ready for deployment.

• fleet-pattern-analyzer

  Analyze cross-tenant patterns and detect systemic issues from aggregated coverage data. Receives per-org results from org-coverage-reporter agents and identifies platform degradation, coordinated enrollments, SLA compliance patterns, risk concentration, silent sensor patterns, and temporal correlati

• fp-pattern-investigator

  Investigate a single FP pattern to determine if it's truly a false positive or might be a real threat. Designed to be spawned in parallel (one instance per pattern) by the fp-pattern-finder skill. Returns structured verdict with reasoning.

• gap-analyzer

  Analyze coverage gaps and calculate risk scores for sensors in a LimaCharlie organization. Receives sensor classification data from the parent skill and returns risk-scored gap analysis with remediation priorities. Designed to be spawned by the sensor-coverage skill.

• html-renderer

  Render interactive HTML dashboards from structured JSON data using Jinja2 templates and D3.js charts. Designed to be spawned by the graphic-output skill. Produces self-contained HTML files with embedded visualizations. Built with strict data accuracy guardrails - NEVER fabricates data.

• ioc-hunter

  Search for IOCs within a SINGLE LimaCharlie organization. Designed to be spawned in parallel (one instance per org) by the threat-report-evaluation skill. Returns summarized findings classified by severity.

• multi-org-adapter-auditor

  Audit adapters for a single LimaCharlie organization. Designed for parallel execution by the adapter-assistant skill. Returns adapter inventory, error states, and configuration issues.

• org-coverage-reporter

  Collect comprehensive coverage data for a SINGLE LimaCharlie organization. Designed to be spawned in parallel (one instance per org) by the sensor-coverage skill. Gathers sensor inventory, classifies by offline duration, validates telemetry health, calculates risk scores, and returns structured JSON

• org-doc-collector

  Collect complete configuration inventory for a SINGLE LimaCharlie organization. Designed to be spawned by the org-documentation skill. Gathers sensors, D&R rules, AI agents, extensions, outputs, cloud adapters, secrets, installation keys, SOPs, lookups, tags, payloads, FP rules, and API keys. Return

• org-reporter

  Collect comprehensive reporting data for a SINGLE LimaCharlie organization. Designed to be spawned in parallel (one instance per org) by the reporting skill. Gathers usage stats, billing, sensors, detections, and rules. Returns structured data for aggregation.

• threat-report-parser

  Parse threat reports (PDF, HTML, text files) and extract ALL IOCs and behaviors. Returns structured JSON with categorized indicators. Designed to be spawned by the threat-report-evaluation skill to offload report parsing from main context. Expects reports to already be downloaded to local files.

• vm-edr-installer

  Deploy LimaCharlie EDR to VMs on a single cloud platform using native deployment methods (OS Config for GCP, SSM for AWS, Run Command for Azure). Designed to be spawned in parallel (one instance per platform) by the onboard-new-org skill. Handles installation key retrieval, command execution, and de