detection-engineering

Name: detection-engineering
Availability: InStock
Author: refractionPOINT

Generate, test, and deploy LimaCharlie D&R rules with user approval.

29|3|Updated Dec 21, 2025

Search Tags:#security #rules #LCQL #ai-assisted #detection-engineering #d&r

Ready to run

npx skills add https://github.com/refractionPOINT/lc-ai --skill detection-engineering

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: detection-engineering
Source: https://github.com/refractionPOINT/lc-ai/tree/main/marketplace/plugins/lc-essentials/skills/detection-engineering
Command: npx skills add https://github.com/refractionPOINT/lc-ai --skill detection-engineering

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill acts as an expert Detection Engineer to help create, test, and deploy D&R rules in LimaCharlie. It guides through threat understanding, data research (Schema, LCQL, Timeline), detection logic generation, rule testing against sample and historical data, and deployment of validated rules. Use it for building detections, writing D&R rules, testing logic, or when you want to detect specific behaviors or threats.

Core Features & Use Cases

AI-generated detection rules and response logic for LimaCharlie
Guided research of event schemas, LCQL queries, and timeline data
Iterative testing against sample and historic data with validation steps
Safe deployment with user approvals and documentation

Quick Start

Example: Generate a detector for encoded PowerShell in last 24h, test against sample events, then deploy.

Frequently Asked Questions about detection-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate D&R rules for detecting threats in LimaCharlie?▼

D&R rules are detection and response logic built in LimaCharlie's LCQL query language. This Skill generates AI-driven rules by analyzing event schemas, writing LCQL queries, and testing them against sample and historical data before deployment, eliminating manual coding.

Can I use AI to write and test LCQL detection rules?▼

Yes. This Skill uses AI to generate LCQL queries and D&R rule components, then validates them through iterative testing against Windows, Linux, and macOS events with explicit user approval before deployment.

What's the best way to build detections for specific behaviors or threats?▼

Follow a guided workflow: understand the threat, research event schemas and timelines, generate detection logic with AI, test against sample and historical data, validate results, and deploy with documentation—all within a single iterative process.

Do I need to know LCQL to create LimaCharlie detection rules?▼

No. This Skill generates LCQL and D&R rule syntax automatically through AI assistance. You guide the threat research and approve the results; the Skill handles rule composition and validation across platforms.

How do I test detection rules before deploying them?▼

This Skill tests rules against both sample events and historical data, running validation checks to confirm logic correctness. You review test results and approve each rule before deployment to ensure it detects the intended behavior.

Can I detect specific behaviors like encoded PowerShell across multiple operating systems?▼

Yes. Generate detections for Windows, Linux, and macOS data in a single workflow. The Skill researches platform-specific event schemas, builds rules with AI, tests them, and deploys validated detections across all three operating systems.