detection-engineering

D&R rules are detection and response logic built in LimaCharlie's LCQL query language. This Skill generates AI-driven rules by analyzing event schemas, writing LCQL queries, and testing them against sample and historical data before deployment, eliminating manual coding.

Yes. This Skill uses AI to generate LCQL queries and D&R rule components, then validates them through iterative testing against Windows, Linux, and macOS events with explicit user approval before deployment.

Follow a guided workflow: understand the threat, research event schemas and timelines, generate detection logic with AI, test against sample and historical data, validate results, and deploy with documentation—all within a single iterative process.

No. This Skill generates LCQL and D&R rule syntax automatically through AI assistance. You guide the threat research and approve the results; the Skill handles rule composition and validation across platforms.

This Skill tests rules against both sample events and historical data, running validation checks to confirm logic correctness. You review test results and approve each rule before deployment to ensure it detects the intended behavior.

Yes. Generate detections for Windows, Linux, and macOS data in a single workflow. The Skill researches platform-specific event schemas, builds rules with AI, tests them, and deploys validated detections across all three operating systems.