onboard-new-org

What this skill does

# Onboard New Organization

A comprehensive onboarding wizard that discovers cloud infrastructure, identifies assets for monitoring, and guides through EDR deployment and log source integration for LimaCharlie organizations.

---

## LimaCharlie Integration

> **Prerequisites**: Run `/init-lc` to initialize LimaCharlie context.

### LimaCharlie CLI Access

All LimaCharlie operations use the `limacharlie` CLI directly:

```bash
limacharlie <noun> <verb> --oid <oid> --output yaml [flags]
```

For command help and discovery: `limacharlie <command> --ai-help`

### Critical Rules

| Rule | Wrong | Right |
|------|-------|-------|
| **CLI Access** | Call MCP tools or spawn api-executor | Use `Bash("limacharlie ...")` directly |
| **Output Format** | `--output json` | `--output yaml` (more token-efficient) |
| **Filter Output** | Pipe to jq/yq | Use `--filter JMESPATH` to select fields |
| **LCQL Queries** | Write query syntax manually | Use `limacharlie ai generate-query` first |
| **Timestamps** | Calculate epoch values | Use `date +%s` or `date -d '7 days ago' +%s` |
| **OID** | Use org name | Use UUID (call `limacharlie org list` if needed) |

---

## When to Use

Use this skill when:

- **Setting up a new LimaCharlie organization**: Full onboarding of cloud infrastructure
- **Connecting cloud platforms**: GCP, AWS, Azure, DigitalOcean, or other cloud providers
- **Deploying EDR to cloud VMs**: Mass deployment of LimaCharlie agents
- **Onboarding hybrid environments**: Mix of cloud VMs and log sources
- **Expanding monitoring coverage**: Adding new cloud projects or accounts

Common scenarios:
- "I want to onboard my AWS environment to LimaCharlie"
- "Set up monitoring for all my GCP VMs"
- "Connect my Azure audit logs and deploy EDR to my VMs"
- "I have a new organization, help me set everything up"
- "What can I monitor from my cloud infrastructure?"

## What This Skill Does

This skill performs a complete onboarding workflow:

1. **Organization Selection**: Select target LimaCharlie organization
2. **Cloud CLI Discovery**: Detect installed and authenticated cloud CLIs
3. **Infrastructure Survey**: Discover projects, VMs, and security-relevant services
4. **Onboarding Plan**: Suggest what should be monitored (with user confirmation)
5. **Cloud Adapter Setup**: Create adapters for log sources (via adapter-assistant)
6. **EDR Deployment**: Install agents on VMs using cloud-native methods
7. **Verification**: Confirm sensors online and data flowing
8. **Final Report**: Generate comprehensive onboarding summary

### Supported Cloud Platforms

| Platform | CLI | VM Deployment Method | Log Sources |
|----------|-----|---------------------|-------------|
| **GCP** | gcloud | OS Config | Cloud Audit Logs, VPC Flow Logs, Cloud Armor, IAM logs |
| **AWS** | aws | SSM Run Command | CloudTrail, VPC Flow Logs, GuardDuty, IAM logs |
| **Azure** | az | VM Run Command | Activity Log, Azure AD, NSG Flow Logs, Key Vault |
| **DigitalOcean** | doctl | SSH (manual) | Audit logs (API-based) |

## Workflow Phases

### Phase 0: Organization Selection

Ask user to select the target LimaCharlie organization:

```bash
limacharlie org list --output yaml
```

Present available organizations and use AskUserQuestion to let user select one.

### Phase 1: Cloud CLI Discovery

Detect installed and authenticated cloud CLIs:

```bash
# GCP
which gcloud && gcloud auth list 2>/dev/null | grep -q ACTIVE && echo "GCP: authenticated"

# AWS
which aws && aws sts get-caller-identity 2>/dev/null && echo "AWS: authenticated"

# Azure
which az && az account show 2>/dev/null && echo "Azure: authenticated"

# DigitalOcean
which doctl && doctl account get 2>/dev/null && echo "DigitalOcean: authenticated"
```

Present discovered CLIs and ask user which platforms to onboard:

```
AskUserQuestion(
  questions=[{
    "question": "Which cloud platforms would you like to onboard?",
    "header": "Platforms",
    "multiSelect": true,
    "options": [
      {"label": "GCP", "description": "Google Cloud Platform"},
      {"label": "AWS", "description": "Amazon Web Services"},
      {"label": "Azure", "description": "Microsoft Azure"},
      {"label": "DigitalOcean", "description": "DigitalOcean"}
    ]
  }]
)
```

### Phase 2: Infrastructure Survey

For each selected platform, discover projects/accounts and resource types.

#### GCP Survey

```bash
# List projects
gcloud projects list --format="json"

# For each project, check enabled APIs
gcloud services list --project=PROJECT_ID --enabled --format="json"
```

Key services to check for security relevance:
- `logging.googleapis.com` - Cloud Logging (audit logs available)
- `compute.googleapis.com` - Compute Engine VMs
- `container.googleapis.com` - GKE clusters
- `iam.googleapis.com` - IAM (identity logs)
- `cloudresourcemanager.googleapis.com` - Organization-level audit
- `cloudasset.googleapis.com` - Asset inventory

#### AWS Survey

```bash
# Get current account
aws sts get-caller-identity --output json

# List regions with activity
aws ec2 describe-regions --output json

# For each region, list EC2 instances
aws ec2 describe-instances --region REGION --output json

# Check CloudTrail status
aws cloudtrail describe-trails --output json
```

Key services:
- EC2 instances (for EDR)
- CloudTrail (audit logs)
- GuardDuty (threat detection)
- VPC Flow Logs
- IAM (identity events)

#### Azure Survey

```bash
# List subscriptions
az account list --output json

# For each subscription, list resource groups
az group list --subscription SUB_ID --output json

# List VMs
az vm list --subscription SUB_ID --output json

# Check diagnostic settings
az monitor diagnostic-settings list --resource RESOURCE_ID --output json
```

Key services:
- Virtual Machines (for EDR)
- Activity Log (audit events)
- Azure AD / Entra ID (identity)
- NSG Flow Logs (network)
- Key Vault audit logs

#### DigitalOcean Survey

```bash
# List droplets
doctl compute droplet list --format json

# List projects
doctl projects list --format json
```

### Phase 3: Resource Discovery and Classification

After surveying, categorize discovered resources:

#### Virtual Machines (EDR Targets)

Present discovered VMs with OS information:

| Platform | Instance ID | Name | OS | Zone/Region | Status |
|----------|-------------|------|----|-----------:|--------|
| GCP | instance-1 | web-server | Ubuntu 22.04 | us-central1-a | RUNNING |
| AWS | i-abc123 | api-server | Amazon Linux 2 | us-east-1 | running |
| Azure | vm-001 | database | Windows Server 2022 | eastus | running |

Ask user to confirm which VMs should have EDR installed:

```
AskUserQuestion(
  questions=[{
    "question": "Which VMs should have the LimaCharlie EDR installed?",
    "header": "VMs",
    "multiSelect": true,
    "options": [
      {"label": "All Linux VMs (Recommended)", "description": "Install EDR on all discovered Linux VMs"},
      {"label": "All Windows VMs", "description": "Install EDR on all discovered Windows VMs"},
      {"label": "Production VMs only", "description": "Only VMs tagged as production"},
      {"label": "Let me select individually", "description": "Choose specific VMs"}
    ]
  }]
)
```

#### Security-Relevant Log Sources

Identify log sources with security value:

| Priority | Source | Platform | Type | Description |
|----------|--------|----------|------|-------------|
| High | CloudTrail | AWS | Audit | API activity, authentication |
| High | Cloud Audit Logs | GCP | Audit | Admin and data access logs |
| High | Azure Activity Log | Azure | Audit | Control plane operations |
| High | Azure AD Sign-ins | Azure | Identity | Authentication events |
| Medium | VPC Flow Logs | AWS/GCP | Network | Network traffic metadata |
| Medium | GuardDuty | AWS | Threat Intel | AWS threat findings |
| Medium | NSG Flow Logs | Azure | Network | Network traffic |
| Low | Custom app logs | Various | Application | App-specific logging |

Ask user to confirm log sources:

```
AskUserQuestion(
  questions=[{
    "question": "W