platform-config

What this skill does

# Platform Config

How to work with LimaCharlie's configuration layer — Hive, outputs, extensions, lookups, secrets, YARA rules, API keys, and permissions.

## Hive (Generic Config Store)

Hive provides a single CRUD API for all configuration records. Each record has an envelope (name, enabled flag, metadata) with JSON data.

### Use the Dedicated CLI First

**Reach for the shortcut command before the generic `hive` command** — it's safer (no chance of a wrong `--hive-name`) and the help text is type-specific. The shortcut name does **not** always match the underlying hive name; never construct a hive name from the shortcut.

| Shortcut command | Underlying hive name |
|------------------|----------------------|
| `limacharlie dr` | `dr-general` (also `dr-managed`, `dr-service`) |
| `limacharlie fp` | `fp` |
| `limacharlie lookup` | `lookup` |
| `limacharlie secret` | `secret` |
| `limacharlie yara` | `yara` |
| `limacharlie cloud-adapter` | **`cloud_sensor`** ← name mismatch |
| `limacharlie external-adapter` | `external_adapter` |
| `limacharlie playbook` | `playbook` |
| `limacharlie sop` | `sop` |
| `limacharlie ai-agent` | `ai_agent` |
| `limacharlie ai-skill` | `ai_skill` |
| `limacharlie ai-memory` | `ai_memory` (partial-merge writes per `--memory-name`) |
| `limacharlie extension config-*` | `extension_config` |
| `limacharlie search saved-*` | `query` |

If unsure of a hive name, run `limacharlie hive list-types --output yaml` for the authoritative list.

### Generic Hive Operations

Only fall back to these when there's no shortcut for the type you need:

```bash
# List records in a hive
limacharlie hive list --hive-name <hive_type> --oid <oid> --output yaml

# Get a record
limacharlie hive get --hive-name <hive_type> --key <name> --oid <oid> --output yaml

# Set a record
limacharlie hive set --hive-name <hive_type> --key <name> --input-file /tmp/data.yaml --oid <oid> --output yaml

# Delete a record
limacharlie hive delete --hive-name <hive_type> --key <name> --confirm --oid <oid>

# Enable/disable a record
limacharlie hive enable --hive-name <hive_type> --key <name> --oid <oid>
limacharlie hive disable --hive-name <hive_type> --key <name> --oid <oid>
```

## Outputs

Stream telemetry to external destinations.

```bash
# List outputs
limacharlie output list --oid <oid> --output yaml

# Create output (write config to file first)
cat > /tmp/output.yaml << 'EOF'
name: my-syslog
module: syslog
for: detect
dest_host: siem.example.com:514
EOF
limacharlie output create --input-file /tmp/output.yaml --oid <oid> --output yaml

# Delete output
limacharlie output delete --name <name> --confirm --oid <oid>
```

Each output subscribes to one or more streams: `event`, `detect`, `audit`, `deployment`.

## Extensions

Optional capabilities enabled per-org.

```bash
# List subscribed extensions
limacharlie extension list --oid <oid> --output yaml

# List ALL available extensions (marketplace — subscribed and unsubscribed)
limacharlie extension list-available --oid <oid> --output yaml

# Subscribe to an extension
limacharlie extension subscribe --name <ext-name> --oid <oid>

# Unsubscribe
limacharlie extension unsubscribe --name <ext-name> --oid <oid>

# Rotate an extension's API key
limacharlie extension rekey --name <ext-name> --oid <oid>

# List all extension configs
limacharlie extension config-list --oid <oid> --output yaml

# Get extension config
limacharlie extension config-get --name <ext-name> --oid <oid> --output yaml

# Set extension config
limacharlie extension config-set --name <ext-name> --input-file /tmp/config.yaml --oid <oid>

# Delete extension config
limacharlie extension config-delete --name <ext-name> --confirm --oid <oid>

# Get extension config schema
limacharlie extension schema --name <ext-name> --oid <oid> --output yaml

# Make extension request (invoke an action)
limacharlie extension request --name <ext-name> --action <action> --oid <oid> --output yaml
limacharlie extension request --name <ext-name> --action <action> --data '<json>' --oid <oid> --output yaml
```

Use `list-available` to discover what extensions exist before subscribing. Use `list` to check what's already subscribed in an org.

### Extension Config as Web UI Features

Several web UI features are configured as extension configs:

| Web UI Feature | Extension Name |
|----------------|---------------|
| Artifact Collection Rules | `ext-artifact` |
| File & Registry Integrity Monitoring | `ext-integrity` |
| EPP / Defender Integration | `ext-epp` |
| Exfil Watch | `ext-exfil` |

### Copying Extension Configs Between Orgs

1. Export: `limacharlie extension config-get --name <ext> --oid <source>`
2. Extract the `data:` section to a file
3. Import: `limacharlie extension config-set --name <ext> --input-file <file> --oid <target>`
4. Enable: `limacharlie hive enable --hive-name extension_config --key <ext> --oid <target>`

The target org must already be subscribed to the extension.

## Lookups

Key-value dictionaries queryable at runtime in D&R rules for enrichment and detection logic. Referenced in rules via the `lookup` operator with `resource: hive://lookup/<name>`.

### CLI Operations

```bash
# List lookups
limacharlie lookup list --oid <oid> --output yaml

# Get a lookup
limacharlie lookup get --key <name> --oid <oid> --output yaml

# Set a lookup
limacharlie lookup set --key <name> --input-file /tmp/lookup.yaml --oid <oid> --output yaml

# Delete a lookup
limacharlie lookup delete --key <name> --confirm --oid <oid>
```

### Lookup Data Formats

Lookups support three data formats in their payload:

| Format | Description | Use Case |
|--------|-------------|----------|
| `lookup_data` | Direct JSON `{ "key": { metadata } }` | Structured data with per-key metadata |
| `newline_content` | Keys separated by newlines (empty metadata) | Simple blocklists/allowlists |
| `yaml_content` | YAML string with dictionary keys and metadata | Human-readable configs |

### How Lookups Work in D&R Rules

When a D&R rule uses `op: lookup`, the value at `path` is looked up in the referenced resource. If the key exists, the rule matches and the **metadata dictionary** for that key is returned. The metadata is accessible in suppression keys via the `.mtd` namespace.

**Gotcha**: lookups return the metadata dict `{}` on match — if the key has no metadata, you get an empty dict. The match itself is the meaningful signal, not the returned value.

**Gotcha**: the `.mtd` key name for `hive://lookup/my-list` is `.mtd.my_list` (hyphens become underscores).

### Lookup Manager Extension

The Lookup Manager extension (`ext-lookup-manager`) auto-refreshes lookups every 24 hours from remote sources (URLs or ARLs). Pre-configured public lookups are available from the [lc-public-lookups GitHub repo](https://github.com/refractionpoint/lc-public-lookups), including Tor exit nodes, AlienVault IP reputation, and more.

### IaC Format

```yaml
hives:
  lookup:
    my-blocklist:
      data:
        lookup_data:
          8.8.8.8: {}
          1.1.1.1: { category: dns }
      usr_mtd:
        enabled: true
        expiry: 0
        tags: [blocklist]
```

## Secrets

Secure credential storage. Referenced via `hive://secret/<name>`.

```bash
# List secrets (shows names only, not values)
limacharlie secret list --oid <oid> --output yaml

# Set a secret
limacharlie secret set --key <name> --oid <oid>
# (prompts for value, or use --input-file)

# Delete a secret
limacharlie secret delete --key <name> --confirm --oid <oid>
```

## YARA Rules

YARA in LimaCharlie has two concepts: **sources** (where rules come from) and **rules** (compiled rule sets).

```bash
# List YARA sources
limacharlie yara sources-list --oid <oid> --output yaml

# Add a YARA source
limacharlie yara source-add --name <name> --source-file /tmp/source.yaml --oid <oid> --output yaml

# Get a YARA source
limacharlie yara source-get --name <name> --oid <oid> --output yaml

# Delete a YARA source
limacharlie yara source-delete --name <name> --o