Why shouldn't I call MCP tools directly?

This skill uses a specialized executor sub-agent to handle large data results and ensures parameter accuracy by loading specific function documentation before execution.

Is a LimaCharlie account required to use this skill?

Yes, you must have an active LimaCharlie account and run the /init-lc command to initialize your environment context and authentication.

What kind of live response actions can I perform?

You can list processes, browse file systems, run YARA scans, isolate sensors from the network, and manage persistence mechanisms like autoruns in real-time.

Can I run LCQL queries for data older than 30 days?

Yes, but the skill will prompt for cost confirmation and provide an estimate before executing queries on historical data outside the free 30-day window.

LimaCharlie Security Ops

Name: LimaCharlie Security Ops
Author: refractionPOINT

byrefractionPOINT

•

セキュリティとテスト

Automates LimaCharlie security operations including sensor management, threat hunting, and detection engineering via a specialized sub-agent.

概要

This skill serves as the central hub for all LimaCharlie platform interactions within Claude Code, providing access to over 170 specialized functions. It simplifies complex security workflows such as listing sensors, executing LCQL queries for threat hunting, managing Detection & Response (D&R) rules, and performing live response actions like network isolation or YARA scanning. By leveraging a dedicated executor sub-agent and enforced documentation loading, it ensures accurate API calls, proper parameter usage, and efficient multi-agent parallel execution for large-scale security telemetry analysis.

主な機能

Dedicated executor sub-agent for handling large API responses and parallel processing
Real-time sensor operations including live process monitoring and network isolation
Access to 170+ LimaCharlie API functions for comprehensive security management
Streamlined Detection & Response (D&R) rule creation, validation, and testing
Automated LCQL query generation and cost-aware execution for threat hunting
3 GitHub stars

ユースケース

Searching for Indicators of Compromise (IOCs) across an entire organization using LCQL
Performing emergency incident response by isolating compromised sensors and running YARA scans
Managing large-scale security configurations, including detection rules and data outputs

概要

主な機能

Dedicated executor sub-agent for handling large API responses and parallel processing
Real-time sensor operations including live process monitoring and network isolation
Access to 170+ LimaCharlie API functions for comprehensive security management
Streamlined Detection & Response (D&R) rule creation, validation, and testing
Automated LCQL query generation and cost-aware execution for threat hunting
3 GitHub stars

ユースケース

Searching for Indicators of Compromise (IOCs) across an entire organization using LCQL
Performing emergency incident response by isolating compromised sensors and running YARA scans
Managing large-scale security configurations, including detection rules and data outputs