lc-essentials

Plugin lc-essentials from marketplace lc-marketplace in refractionPOINT/lc-ai. Commands read from the repo's manifest — 2 days ago.

Skills (10)

• detection-engineering

  Expert Detection Engineer assistant for creating and testing D&R rules in LimaCharlie. Guides through understanding threats, researching event data (Schema, LCQL, Timeline), generating detection logic, testing rules against sample and historical data, and deploying validated rules. Use for building

• detection-tuner

  Investigate noisy/common alerts and create false positive (FP) rules to suppress benign detections. Analyzes detection frequency over 7 days, identifies patterns, generates and tests FP rules with operator approval before deployment. Use for tuning detection noise, reducing alert fatigue, suppressin

• feedback

  Send interactive feedback requests to humans via ext-feedback channels. Request approvals (approve/deny), acknowledgements, or free-form text answers through Slack, Telegram, Teams, Email, or built-in Web UI. Responses go to a case (note), playbook (trigger), or ai_agent (starts AI session). Use for

• fleet-payload-tasking

  Deploy payloads and shell commands fleet-wide using reliable tasking. Execute scripts, collect data, or run commands across all endpoints with automatic handling of offline sensors. Use for vulnerability scanning, data collection, software inventory, compliance checks, or any fleet-wide operation.

• case-investigation

  Investigate security cases from the LimaCharlie Cases extension. Performs HOLISTIC investigations - not just process trees, but initial access hunting, org-wide scope assessment, lateral movement detection, and full host context. Enriches cases with telemetry references, entities/IOCs, analyst notes

• lookup-lc-doc

  Search and retrieve LimaCharlie documentation from GitHub repositories. Use when users ask about LimaCharlie platform features, SDKs, APIs, D&R rules, LCQL, sensors, outputs, extensions, integrations, AI skills, agents, or any LimaCharlie-related topics.

• sensor-health

  Generate comprehensive sensor health and status reports across all LimaCharlie organizations. Use when users ask about sensor connectivity, data availability, offline sensors, sensors not reporting events, or fleet-wide health queries (e.g., "show me sensors online but not sending data", "list senso

• sensor-tasking

  Send tasks (commands) to EDR sensors to gather data or take action. Handles offline agents via reliable-tasking, collects responses via LCQL queries, and creates D&R rules for automated response handling. Use for live response, data collection, forensic acquisition, or fleet-wide operations like "ge

• velociraptor

  Velociraptor DFIR integration for LimaCharlie. List available VQL artifacts, view artifact definitions, launch forensic collections on endpoints. Find raw collection data in Artifacts (type:velociraptor, source:SID). Query processed JSON events from the 'velociraptor' sensor (tag:ext:ext-velocirapto

• web-ui-link

  Generate URLs for the LimaCharlie web application interface. Quickly open the web UI for any feature: dashboard, sensors, detections, D&R rules, FP rules, secrets, outputs, lookups, payloads, YARA rules, artifacts, investigations, extensions, adapters, installation keys, billing, users, playbooks, A

Slash commands (2)

• /lc-essentials:ask

  Ask a question about LimaCharlie and get an answer from the documentation. Usage: /lc-essentials:ask <your question>

• /lc-essentials:init-lc

  Initialize the current working directory's CLAUDE.md with LimaCharlie CLI guidelines. Merges AUTOINIT.md content into a '# Using LimaCharlie' section. Safe to run multiple times.

Subagents (3)

• dr-replay-tester

  Test D&R rules via historical replay against a SINGLE LimaCharlie organization. Designed to be spawned in parallel (one instance per org) by the detection-engineering skill. Returns summarized results (stats, samples, patterns) instead of all matches.

• sensor-health-reporter

  Check sensor health for a SINGLE LimaCharlie organization. This agent is designed to be spawned in parallel (one instance per org) by the sensor-health skill. Accepts org ID and parameters in the prompt, returns findings for that org only.

• sensor-tasking-executor

  Execute sensor tasks (live response commands) on a single sensor and return results. Designed for parallel execution by parent skills. Handles online verification, task execution, and result formatting.

Hooks (1)

• SessionStart

  node -e "const{execFileSync:xf,execSync:xs}=require('child_process'),{existsSync:ex,appendFileSync:af}=require('fs'),{homedir:hd,platform:pf}=require('os'),{join:j,dirname:dn}=require('path'),w=pf()==