detection-engineering

Expert Detection Engineer assistant for creating and testing D&R rules in LimaCharlie. Guides through understanding threats, researching event data (Schema, LCQL, Timeline), generating detection logic, testing rules against sample and historical data, and deploying validated rules. Use for building detections, writing D&R rules, testing detection logic, or when user wants to detect specific behaviors or threats.

$ Instalar

git clone https://github.com/refractionPOINT/documentation /tmp/documentation && cp -r /tmp/documentation/marketplace/plugins/lc-essentials/skills/detection-engineering ~/.claude/skills/documentation

// tip: Run this command in your terminal to install the skill