limacharlie-iac

What this skill does

# LimaCharlie Infrastructure as Code Manager

Manage multi-tenant LimaCharlie configurations using git-based Infrastructure as Code, compatible with the `ext-git-sync` extension.

---

## LimaCharlie Integration

> **Prerequisites**: Run `/init-lc` to initialize LimaCharlie context.

### LimaCharlie CLI Access

All LimaCharlie operations use the `limacharlie` CLI directly:

```bash
limacharlie <noun> <verb> --oid <oid> --output yaml [flags]
```

For command help and discovery: `limacharlie <command> --ai-help`

### Critical Rules

| Rule | Wrong | Right |
|------|-------|-------|
| **CLI Access** | Call MCP tools or spawn api-executor | Use `Bash("limacharlie ...")` directly |
| **Output Format** | `--output json` | `--output yaml` (more token-efficient) |
| **Filter Output** | Pipe to jq/yq | Use `--filter JMESPATH` to select fields |
| **D&R Rules** | Write YAML manually | Use `limacharlie ai generate-*` + `limacharlie dr validate` |
| **OID** | Use org name | Use UUID (call `limacharlie org list` if needed) |

---

## Overview

This skill helps you manage LimaCharlie organizations using Infrastructure as Code:

```
┌─────────────────────────────────────────────────────────────────┐
│  IaC REPOSITORY (ext-git-sync compatible)                       │
│                                                                 │
│  org-manifest.yaml        ← Friendly name → OID mapping         │
│                                                                 │
│  hives/                   ← GLOBAL configs (all tenants)        │
│  ├── dr-general.yaml         D&R rules                          │
│  ├── fp.yaml                 False positives                    │
│  ├── outputs.yaml            Output destinations                │
│  ├── extensions.yaml         Extensions to enable               │
│  ├── integrity.yaml          FIM rules                          │
│  └── ...                                                        │
│                                                                 │
│  orgs/                    ← PER-TENANT configs                  │
│  ├── <oid-1>/                                                   │
│  │   ├── index.yaml          Includes global + custom           │
│  │   └── custom/             Tenant-specific overrides          │
│  │       ├── rules.yaml                                         │
│  │       └── fim.yaml                                           │
│  └── <oid-2>/                                                   │
│      └── index.yaml                                             │
│                                                                 │
│  exports/                 ← Auto-generated by ext-git-sync      │
│  └── orgs/...                                                   │
└─────────────────────────────────────────────────────────────────┘
```

## Key Concepts

### ext-git-sync Compatibility

This skill generates repositories compatible with LimaCharlie's `ext-git-sync` extension:
- Folder names under `orgs/` are OIDs (required by ext-git-sync)
- Each org has an `index.yaml` that includes global and custom configs
- Global configs in `hives/` are shared via relative path includes

### Friendly Name Mapping

Since OID folders are hard to read, the skill maintains `org-manifest.yaml`:

```yaml
version: 1
orgs:
  acme-corp:
    oid: 7e41e07b-c44c-43a3-b78d-41f34204789d
    description: "Acme Corporation - Production"
    added: "2025-11-30"

  globex:
    oid: a326700d-3cd7-49d1-ad08-20b396d8549d
    description: "Globex Industries"
    added: "2025-11-30"
```

You refer to orgs by friendly name; the skill translates to OIDs.

---

## Commands

### Initialize Repository

**"Set up a new IaC repo"** or **"Initialize LimaCharlie IaC at /path/to/repo"**

Creates a new ext-git-sync compatible repository:

```
<repo-path>/
├── org-manifest.yaml
├── hives/
│   ├── dr-general.yaml
│   ├── fp.yaml
│   ├── outputs.yaml
│   ├── extensions.yaml
│   ├── integrity.yaml
│   ├── artifact.yaml
│   ├── exfil.yaml
│   ├── resources.yaml
│   └── installation_keys.yaml
├── orgs/
│   └── .gitkeep
├── exports/
│   └── .gitkeep
├── README.md
└── .gitignore
```

**Workflow:**
1. Create directory structure
2. Initialize global config files with `version: 3` headers
3. Create empty `org-manifest.yaml`
4. Initialize git repository
5. Provide instructions for ext-git-sync setup

---

### Add Existing Tenant

**"Add tenant acme-corp"** or **"Add org Acme Corporation to IaC"**

Adds an existing LimaCharlie organization to the repository:

**Workflow:**
1. Look up organization by name using `limacharlie org list --output yaml`
2. Confirm with user if multiple matches
3. Create `orgs/<oid>/index.yaml` with global includes
4. Create `orgs/<oid>/custom/` directory for future customizations
5. Add entry to `org-manifest.yaml`
6. Optionally: Export current config from LC using ext-git-sync or `limacharlie sync pull`
7. Commit changes

**Example index.yaml generated:**
```yaml
version: 3
include:
  # Global configurations
  - ../../hives/extensions.yaml
  - ../../hives/dr-general.yaml
  - ../../hives/fp.yaml
  - ../../hives/outputs.yaml
  - ../../hives/integrity.yaml
  - ../../hives/artifact.yaml
  - ../../hives/exfil.yaml
  - ../../hives/resources.yaml
  - ../../hives/installation_keys.yaml
  # Custom configurations for this org (uncomment as needed)
  # - custom/rules.yaml
  # - custom/fim.yaml
  # - custom/outputs.yaml
```

---

### Create New Organization

**"Create new org called acme-corp"** or **"Create tenant Acme Corporation in US region"**

Creates a new organization in LimaCharlie AND adds it to the repository:

**Workflow:**
1. Use `create_org` to create organization in LC
2. Follow "Add Existing Tenant" workflow
3. Provide installation key information

---

### Remove Tenant from IaC

**"Remove acme-corp from IaC"** (does NOT delete the org in LC)

**Workflow:**
1. Look up OID from `org-manifest.yaml`
2. Remove `orgs/<oid>/` directory
3. Remove entry from `org-manifest.yaml`
4. Commit changes

---

## Rule Management

### Add Global Rule (New)

**"Add detection for encoded PowerShell to all tenants"**
**"Create global rule to detect mimikatz"**

Creates a NEW rule and adds it to global config:

**Workflow:**
1. Use AI generation (`limacharlie ai generate-detection`, `limacharlie ai generate-response`)
2. Validate with `limacharlie dr validate`
3. Append to `hives/dr-general.yaml`
4. Commit with descriptive message

---

### Import Rule from Tenant

**"Import rule encoded-powershell from acme-corp"**
**"Get rule mimikatz-detection from globex into IaC"**

Fetches an EXISTING rule from a LimaCharlie tenant and adds it to the IaC repo:

**Workflow:**
1. Look up tenant OID from `org-manifest.yaml`
2. Fetch rule using the CLI:
   ```bash
   limacharlie dr get --key encoded-powershell --oid <tenant-oid> --output yaml
   ```
3. Ask user: Add as **global** (all tenants) or **tenant-specific**?
4. If global: Add to `hives/dr-general.yaml`
5. If tenant-specific: Add to `orgs/<oid>/custom/rules.yaml`
6. Commit changes

---

### Promote Rule to Global

**"Promote rule encoded-powershell from acme-corp to global"**
**"Make rule X from globex apply to all tenants"**

Takes an existing rule from ONE tenant and makes it apply to ALL tenants:

**Workflow:**
1. Look up source tenant OID from `org-manifest.yaml`
2. Fetch rule using `limacharlie dr get --key <name> --oid <oid> --output yaml`
3. Add rule to `hives/dr-general.yaml`
4. Ask user: Remove from tenant's custom config? (if it was tenant-specific)
5. If yes: Remove from `orgs/<oid>/custom/rules.yaml`
6. Commit: "Promote rule [name] from [tenant] to global"

**Example:**
```
User: "Promote rule lateral-movement-psexec from acme-corp to global"

Skill:
1. Fetches rule from acme-corp (OID: 7e41e07b-...)
2. Adds to hives/dr-general.yaml:

   hives:
     dr-general:
       lateral-movement-psexec:
         data:
           detect: ...
           respond: ...
         usr_mtd:
           enabled: