From c0b782239a30bc64261896c62f8269aa694a379a Mon Sep 17 00:00:00 2001 From: dzimine-lc Date: Fri, 20 Feb 2026 12:15:41 -0600 Subject: [PATCH] Remove legacy v1 SDK code, tests, and documentation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The v2 SDK and CLI are fully independent of the legacy v1 code. This removes all legacy modules to make a clean break for the 5.0 release. - Delete 26 legacy PascalCase domain modules (Manager.py, Sensor.py, etc.) - Delete 6 legacy-only utility files (utils.py, request_utils.py, etc.) - Rewrite __init__.py to only re-export __version__ from client.py - Delete 9 legacy unit tests and 8 legacy integration tests - Update test_user_agent.py to use build_user_agent() directly - Rename integration test_v2_*.py → test_*.py - Remove legacy v1 SDK section and migration table from README - Update CLAUDE.md to reflect single-SDK architecture Co-Authored-By: Claude Opus 4.6 --- NEW_CLI.md | 1291 +++++++++ README.md | 86 +- limacharlie/ARL.py | 32 - limacharlie/Billing.py | 35 - limacharlie/Configs.py | 1136 -------- limacharlie/DRCli.py | 100 - limacharlie/Extensions.py | 394 --- limacharlie/Firehose.py | 334 --- limacharlie/Hive.py | 419 --- limacharlie/Jobs.py | 78 - limacharlie/Logs.py | 398 --- limacharlie/Manager.py | 2507 ----------------- limacharlie/Model.py | 303 -- limacharlie/Payloads.py | 91 - limacharlie/Query.py | 506 ---- limacharlie/Replay.py | 480 ---- limacharlie/Replicants.py | 407 --- limacharlie/Search.py | 233 -- limacharlie/SearchAPI.py | 573 ---- limacharlie/Sensor.py | 539 ---- limacharlie/SpotCheck.py | 538 ---- limacharlie/Spout.py | 267 -- limacharlie/Sync.py | 641 ----- limacharlie/USP.py | 352 --- limacharlie/User.py | 118 - limacharlie/UserPreferences.py | 35 - limacharlie/Webhook.py | 28 - limacharlie/WebhookSender.py | 62 - limacharlie/__init__.py | 85 +- limacharlie/oauth.py | 81 - limacharlie/request_utils.py | 47 - limacharlie/term_utils.py | 247 -- limacharlie/time_utils.py | 184 -- limacharlie/utils.py | 362 --- limacharlie/versions.py | 94 - .../integration/{test_v2_ai.py => test_ai.py} | 0 tests/integration/test_artifacts.py | 131 +- .../{test_v2_auth.py => test_auth.py} | 0 .../{test_v2_billing.py => test_billing.py} | 0 ...rehensive.py => test_cli_comprehensive.py} | 0 .../{test_v2_cli_e2e.py => test_cli_e2e.py} | 0 tests/integration/test_core.py | 268 -- .../{test_v2_exfil.py => test_exfil.py} | 0 ...st_v2_extensions.py => test_extensions.py} | 0 .../{test_v2_groups.py => test_groups.py} | 0 .../{test_v2_hive.py => test_hive.py} | 0 tests/integration/test_hive_validation.py | 222 -- tests/integration/test_insight.py | 59 - ...test_v2_integrity.py => test_integrity.py} | 0 .../{test_v2_jobs.py => test_jobs.py} | 0 .../{test_v2_keys.py => test_keys.py} | 0 .../{test_v2_logging.py => test_logging.py} | 0 .../{test_v2_org.py => test_org.py} | 0 ...g_management.py => test_org_management.py} | 0 .../{test_v2_outputs.py => test_outputs.py} | 0 .../{test_v2_replay.py => test_replay.py} | 0 tests/integration/test_replicants.py | 19 - .../{test_v2_rules.py => test_rules.py} | 0 .../{test_v2_search.py => test_search.py} | 0 .../test_search_api_integration.py | 703 ----- .../{test_v2_sensors.py => test_sensors.py} | 0 tests/integration/test_spout.py | 44 - .../{test_v2_stream.py => test_stream.py} | 0 tests/integration/test_sync.py | 228 +- .../{test_v2_users.py => test_users.py} | 0 .../{test_v2_usp.py => test_usp.py} | 0 tests/integration/test_v2_artifacts.py | 85 - tests/integration/test_v2_sync.py | 60 - .../{test_v2_yara.py => test_yara.py} | 0 tests/unit/test_configs.py | 187 -- tests/unit/test_query.py | 61 - tests/unit/test_requests_utils.py | 122 - tests/unit/test_search_api.py | 579 ---- tests/unit/test_search_api_extended.py | 2318 --------------- tests/unit/test_ssl_context.py | 59 - tests/unit/test_term_utils.py | 105 - tests/unit/test_time_utils.py | 926 ------ tests/unit/test_user_agent.py | 279 +- tests/unit/test_usp.py | 390 --- 79 files changed, 1492 insertions(+), 18436 deletions(-) create mode 100644 NEW_CLI.md delete mode 100644 limacharlie/ARL.py delete mode 100644 limacharlie/Billing.py delete mode 100644 limacharlie/Configs.py delete mode 100644 limacharlie/DRCli.py delete mode 100644 limacharlie/Extensions.py delete mode 100644 limacharlie/Firehose.py delete mode 100644 limacharlie/Hive.py delete mode 100644 limacharlie/Jobs.py delete mode 100644 limacharlie/Logs.py delete mode 100644 limacharlie/Manager.py delete mode 100644 limacharlie/Model.py delete mode 100644 limacharlie/Payloads.py delete mode 100644 limacharlie/Query.py delete mode 100644 limacharlie/Replay.py delete mode 100644 limacharlie/Replicants.py delete mode 100644 limacharlie/Search.py delete mode 100644 limacharlie/SearchAPI.py delete mode 100644 limacharlie/Sensor.py delete mode 100644 limacharlie/SpotCheck.py delete mode 100644 limacharlie/Spout.py delete mode 100644 limacharlie/Sync.py delete mode 100644 limacharlie/USP.py delete mode 100644 limacharlie/User.py delete mode 100644 limacharlie/UserPreferences.py delete mode 100644 limacharlie/Webhook.py delete mode 100644 limacharlie/WebhookSender.py delete mode 100644 limacharlie/oauth.py delete mode 100644 limacharlie/request_utils.py delete mode 100644 limacharlie/term_utils.py delete mode 100644 limacharlie/time_utils.py delete mode 100644 limacharlie/utils.py delete mode 100644 limacharlie/versions.py rename tests/integration/{test_v2_ai.py => test_ai.py} (100%) rename tests/integration/{test_v2_auth.py => test_auth.py} (100%) rename tests/integration/{test_v2_billing.py => test_billing.py} (100%) rename tests/integration/{test_v2_cli_comprehensive.py => test_cli_comprehensive.py} (100%) rename tests/integration/{test_v2_cli_e2e.py => test_cli_e2e.py} (100%) delete mode 100644 tests/integration/test_core.py rename tests/integration/{test_v2_exfil.py => test_exfil.py} (100%) rename tests/integration/{test_v2_extensions.py => test_extensions.py} (100%) rename tests/integration/{test_v2_groups.py => test_groups.py} (100%) rename tests/integration/{test_v2_hive.py => test_hive.py} (100%) delete mode 100644 tests/integration/test_hive_validation.py delete mode 100644 tests/integration/test_insight.py rename tests/integration/{test_v2_integrity.py => test_integrity.py} (100%) rename tests/integration/{test_v2_jobs.py => test_jobs.py} (100%) rename tests/integration/{test_v2_keys.py => test_keys.py} (100%) rename tests/integration/{test_v2_logging.py => test_logging.py} (100%) rename tests/integration/{test_v2_org.py => test_org.py} (100%) rename tests/integration/{test_v2_org_management.py => test_org_management.py} (100%) rename tests/integration/{test_v2_outputs.py => test_outputs.py} (100%) rename tests/integration/{test_v2_replay.py => test_replay.py} (100%) delete mode 100644 tests/integration/test_replicants.py rename tests/integration/{test_v2_rules.py => test_rules.py} (100%) rename tests/integration/{test_v2_search.py => test_search.py} (100%) delete mode 100644 tests/integration/test_search_api_integration.py rename tests/integration/{test_v2_sensors.py => test_sensors.py} (100%) delete mode 100644 tests/integration/test_spout.py rename tests/integration/{test_v2_stream.py => test_stream.py} (100%) rename tests/integration/{test_v2_users.py => test_users.py} (100%) rename tests/integration/{test_v2_usp.py => test_usp.py} (100%) delete mode 100644 tests/integration/test_v2_artifacts.py delete mode 100644 tests/integration/test_v2_sync.py rename tests/integration/{test_v2_yara.py => test_yara.py} (100%) delete mode 100644 tests/unit/test_configs.py delete mode 100644 tests/unit/test_query.py delete mode 100644 tests/unit/test_requests_utils.py delete mode 100644 tests/unit/test_search_api.py delete mode 100644 tests/unit/test_search_api_extended.py delete mode 100644 tests/unit/test_ssl_context.py delete mode 100644 tests/unit/test_term_utils.py delete mode 100644 tests/unit/test_time_utils.py delete mode 100644 tests/unit/test_usp.py diff --git a/NEW_CLI.md b/NEW_CLI.md new file mode 100644 index 00000000..e2bd8620 --- /dev/null +++ b/NEW_CLI.md @@ -0,0 +1,1291 @@ +# LimaCharlie Python SDK & CLI v2.0.0 - Design & Implementation Plan + +## Executive Summary + +This document describes the design for a complete rewrite of the LimaCharlie Python SDK and CLI (v2.0.0). The primary design goal is **AI/LLM-first discoverability**: every command, parameter, and concept should be self-documenting enough that an AI agent (like Claude Code) can operate the CLI effectively without prior LimaCharlie knowledge. + +The new CLI covers 100%+ of the current CLI features, plus new capabilities from the API gateway (AI generation, groups, investigations, SOPs, org notes, etc.). + +--- + +## Table of Contents + +1. [Design Principles](#1-design-principles) +2. [CLI Architecture](#2-cli-architecture) +3. [Authentication & Configuration](#3-authentication--configuration) +4. [SDK Core Classes](#4-sdk-core-classes) +5. [Command Groups & Commands](#5-command-groups--commands) +6. [Output & Formatting](#6-output--formatting) +7. [AI/LLM Discoverability Features](#7-aillm-discoverability-features) +8. [Testing Strategy](#8-testing-strategy) +9. [Migration & Packaging](#9-migration--packaging) +10. [Detailed Command Reference](#10-detailed-command-reference) +11. [Implementation Checklist](#11-implementation-checklist) + +--- + +## 1. Design Principles + +### 1.1 AI/LLM-First Discoverability +- [ ] Every command has a `--explain` flag that prints a detailed paragraph explaining what the command does, when to use it, and common patterns +- [ ] Every parameter has a rich `help=` string with type info, examples, and constraints +- [ ] `limacharlie help ` provides concept guides (e.g., `limacharlie help d&r-rules`, `limacharlie help hive`, `limacharlie help lcql`) +- [ ] `limacharlie discover` lists all commands grouped by use-case profile (matching MCP server profiles: sensor_management, detection_engineering, platform_admin, etc.) +- [ ] `limacharlie cheatsheet ` prints quick-reference examples +- [ ] Every error message includes a suggestion for what to do next +- [ ] JSON Schema output available for every command's parameters via `limacharlie schema ` + +### 1.2 Consistent Command Structure +- [ ] All commands follow `limacharlie ` pattern (e.g., `limacharlie sensor list`, `limacharlie rule create`) +- [ ] CRUD operations use consistent verbs: `list`, `get`, `create`, `update`, `delete` +- [ ] Bulk operations use consistent verbs: `export`, `import`, `sync` +- [ ] Destructive operations require `--confirm` or print a confirmation prompt +- [ ] All identifiers use consistent flag names: `--oid`, `--sid`, `--name`, `--key` + +### 1.3 Machine-Readable Output +- [ ] Default output is human-readable tables (for interactive use) +- [ ] `--output json` for JSON (default when stdout is piped/not a TTY) +- [ ] `--output yaml` for YAML +- [ ] `--output csv` for CSV +- [ ] `--output jsonl` for newline-delimited JSON (for streaming) +- [ ] `--quiet` / `-q` suppresses all output except errors +- [ ] Exit codes are meaningful: 0=success, 1=general error, 2=auth error, 3=not found, 4=validation error + +### 1.4 Composability +- [ ] All commands accept `--oid` to specify org (overrides env/config) +- [ ] All create/update commands support `--input-file` to read parameters from JSON/YAML file (rule create, hive set, output create, extension config set, etc.) +- [ ] All list commands support `--filter` for client-side jmespath filtering +- [ ] All list commands support `--limit` and `--offset` for pagination +- [ ] Stdin support for piping data between commands + +--- + +## 2. CLI Architecture + +### 2.1 Entry Point & Framework +- [ ] Use `click` library for CLI framework (replacing raw argparse) +- [ ] Single entry point: `limacharlie` command with click groups +- [ ] Plugin architecture: each command group is a separate module auto-discovered from `limacharlie/commands/` +- [ ] Global options: `--oid`, `--env`, `--output`, `--debug`, `--quiet`, `--profile` +- [ ] Version command: `limacharlie version` (replaces `limacharlie version`) + +### 2.2 Module Structure + +v2 replaces the existing code directly in the `limacharlie/` package (no backwards compatibility with v1 needed). Old v1 modules are removed. + +``` +limacharlie/ +├── __init__.py +├── __main__.py # Entry point: limacharlie CLI +├── cli.py # Main CLI entry point & click groups +├── config.py # Auth & configuration management +├── client.py # HTTP client with retry, auth, rate limiting +├── output.py # Output formatting (json/yaml/csv/table) +├── errors.py # Custom exception hierarchy +├── help_topics.py # Inline help topic content +├── discovery.py # Command discovery & explain system +├── sdk/ +│ ├── __init__.py +│ ├── organization.py # Organization management +│ ├── sensor.py # Sensor operations +│ ├── dr_rules.py # Detection & Response rules +│ ├── fp_rules.py # False positive rules +│ ├── hive.py # Hive key-value store +│ ├── outputs.py # Output integrations +│ ├── artifacts.py # Artifact/log management +│ ├── payloads.py # Payload management +│ ├── search.py # Search & LCQL queries +│ ├── insight.py # IOC search & event queries +│ ├── extensions.py # Extension management +│ ├── installation_keys.py # Installation key management +│ ├── ingestion_keys.py # Ingestion key management +│ ├── users.py # User & permission management +│ ├── groups.py # Organization group management +│ ├── api_keys.py # API key management +│ ├── billing.py # Billing & usage +│ ├── spout.py # Real-time streaming (WebSocket) +│ ├── firehose.py # Real-time streaming (TCP/TLS) +│ ├── replay.py # D&R rule replay/testing +│ ├── integrity.py # Integrity monitoring rules +│ ├── exfil.py # Exfil prevention rules +│ ├── logging_rules.py # Logging/log collection rules +│ ├── configs.py # Configuration sync (IaC) +│ ├── ai.py # AI-powered generation +│ ├── investigations.py # Investigation management +│ ├── usp.py # USP adapter validation +│ ├── jobs.py # Service job tracking +│ ├── yara.py # YARA scanning & rule management +│ └── arl.py # Authenticated Resource Locator resolution +├── commands/ +│ ├── __init__.py +│ ├── auth.py # login, logout, whoami, use-org +│ ├── sensor.py # sensor list, get, delete, upgrade, export, dump, sweep +│ ├── rule.py # rule list, get, create, delete, test, ... +│ ├── fp.py # fp list, get, create, delete +│ ├── hive.py # hive list, get, set, delete, validate, ... +│ ├── output_cmd.py # output list, create, delete +│ ├── artifact.py # artifact upload, list, download +│ ├── payload.py # payload list, upload, download, delete +│ ├── search.py # search run, validate, interactive, saved-queries +│ ├── ioc.py # ioc search, batch-search, enrich +│ ├── event.py # event list, get, timeline +│ ├── detection.py # detection list, get +│ ├── extension.py # extension list, subscribe, unsubscribe, convert-rules, ... +│ ├── installation_key.py # installation-key list, create, delete +│ ├── ingestion_key.py # ingestion-key list, create, delete, configure +│ ├── user.py # user list, invite, remove, permission +│ ├── group.py # group list, create, delete, member, ... +│ ├── api_key.py # api-key list, create, delete +│ ├── org.py # org info, create, delete, rename, config, errors, ... +│ ├── billing.py # billing status, details, invoice, plans +│ ├── stream.py # stream events, detections, audit (spout) +│ ├── replay_cmd.py # replay run, test-rule +│ ├── integrity.py # integrity list, create, delete +│ ├── exfil.py # exfil list, create, delete +│ ├── logging_cmd.py # logging list, create, delete +│ ├── sync.py # sync push, pull, diff +│ ├── ai.py # ai generate-rule, generate-query, ... +│ ├── investigation.py # investigation list, get, create, delete +│ ├── usp.py # usp validate +│ ├── schema.py # schema list, get +│ ├── tag.py # tag list, add, remove, mass-tag +│ ├── task.py # task send, reliable-send, list-reliable +│ ├── endpoint_policy.py # endpoint-policy (isolate, rejoin, seal, unseal) +│ ├── yara.py # yara scan, rules, sources +│ ├── cloud_sensor.py # cloud-sensor list, get, set, delete +│ ├── job.py # job list, get, delete, wait +│ ├── arl.py # arl get +│ ├── spotcheck.py # spotcheck run +│ ├── secret.py # secret list, get, set, delete (NEW) +│ ├── lookup.py # lookup list, get, set, query, delete (NEW) +│ ├── playbook.py # playbook list, get, set, delete (NEW) +│ ├── adapter.py # adapter list, get, set, delete (NEW) +│ ├── sop.py # sop list, get, set, delete (NEW) +│ ├── note.py # note list, get, set, delete (NEW) +│ ├── audit.py # audit list +│ └── help_cmd.py # help, discover, cheatsheet, schema +tests/ +├── unit/ +│ ├── __init__.py +│ ├── conftest.py +│ ├── test_cli_commands.py +│ ├── test_config.py +│ ├── test_client.py +│ ├── test_output.py +│ ├── test_errors.py +│ ├── test_sdk_organization.py +│ ├── test_sdk_sensor.py +│ ├── test_sdk_dr_rules.py +│ ├── test_sdk_hive.py +│ ├── test_sdk_search.py +│ ├── test_sdk_configs.py +│ └── ... +└── integration/ + ├── __init__.py + ├── conftest.py # Integration fixtures with cleanup + ├── test_auth.py + ├── test_sensor.py + ├── test_rules.py + ├── test_hive.py + ├── test_outputs.py + ├── test_artifacts.py + ├── test_search.py + ├── test_extensions.py + ├── test_users.py + ├── test_api_keys.py + ├── test_installation_keys.py + ├── test_ingestion_keys.py + ├── test_sync.py + ├── test_replay.py + ├── test_stream.py + ├── test_ai.py + ├── test_billing.py + ├── test_groups.py + ├── test_org_management.py + ├── test_usp.py + ├── test_integrity.py + ├── test_exfil.py + ├── test_logging.py + ├── test_yara.py + ├── test_jobs.py + └── test_cli_e2e.py # End-to-end CLI tests +``` + +- [ ] Create this directory structure (remove all v1 modules) +- [ ] Each command module auto-registers its click group + +### 2.3 Clean Break from v1 +This is a full v2.0.0 rewrite with no backwards compatibility requirement: +- [ ] v2 code replaces v1 code directly in the `limacharlie/` package (no `v2/` subpackage) +- [ ] All v1 modules (Manager.py, Sensor.py, etc.) are removed +- [ ] Entry point `limacharlie` runs the new Click-based CLI +- [ ] SDK classes available as `limacharlie.sdk.*` (e.g., `from limacharlie.sdk.organization import Organization`) +- [ ] No fallback to v1 CLI, no `limacharlie-v1` entry point + +--- + +## 3. Authentication & Configuration + +### 3.1 Credential Storage +- [ ] Same file location: `~/.limacharlie` (YAML format) +- [ ] Support named environments/profiles: `limacharlie auth use-env production` +- [ ] Environment variables: `LC_OID`, `LC_API_KEY`, `LC_UID`, `LC_CURRENT_ENV`, `LC_CREDS_FILE`, `LC_EPHEMERAL_CREDS` +- [ ] Ephemeral mode (no disk writes) via `LC_EPHEMERAL_CREDS=1` +- [ ] File permissions enforced at 600 + +### 3.2 Auth Commands +- [ ] `limacharlie auth login` - Interactive login (OAuth or API key) +- [ ] `limacharlie auth login --api-key --oid ` - Non-interactive API key login +- [ ] `limacharlie auth login --uid --api-key ` - User-scoped API key login +- [ ] `limacharlie auth logout` - Clear stored credentials +- [ ] `limacharlie auth whoami` - Show current identity, permissions, accessible orgs +- [ ] `limacharlie auth test [--permissions perm1,perm2]` - Test current auth and optional specific permissions +- [ ] `limacharlie auth use-env ` - Switch named environment +- [ ] `limacharlie auth list-envs` - List configured environments +- [ ] `limacharlie auth use-org ` - Set default organization (resolves names to OIDs) +- [ ] `limacharlie auth list-orgs [--filter ]` - List accessible organizations + +### 3.3 Client Features +- [ ] Automatic JWT generation and refresh +- [ ] Retry logic: 3 retries with exponential backoff for 429/504 +- [ ] Rate limit awareness: log warnings on rate limit headers +- [ ] Request debugging via `--debug` (prints curl-equivalent commands) +- [ ] User-Agent header: `limacharlie-cli/2.0.0 python/3.x` +- [ ] Idempotent key support for safe retries on write operations + +--- + +## 4. SDK Core Classes + +### 4.1 Client +- [ ] `limacharlie.Client(oid, api_key, uid, environment, jwt, ...)` +- [ ] Automatic credential resolution: explicit params > env vars > config file +- [ ] Thread-safe JWT management with automatic refresh +- [ ] Request/response logging for debugging +- [ ] Rate limit tracking and backoff +- [ ] Context manager support (`with Client(...) as client:`) + +### 4.2 Organization +- [ ] `Organization(client)` - Main entry point for all org-scoped operations +- [ ] Properties: `oid`, `name`, `info`, `urls` +- [ ] Methods for all org-level operations (sensors, rules, hives, etc.) +- [ ] Lazy-loaded cached properties for org info and URLs + +### 4.3 Sensor +- [ ] `Sensor(organization, sid)` - Represents a single sensor +- [ ] Properties: `sid`, `hostname`, `platform`, `architecture`, `external_ip`, `internal_ip`, `is_online`, `is_isolated`, `tags`, `version`, `enrollment_time`, `last_seen` +- [ ] Platform helpers: `is_windows`, `is_linux`, `is_macos`, `is_chrome` +- [ ] Task methods: `task()`, `request()`, `simple_request()` +- [ ] Tag methods: `add_tag()`, `remove_tag()`, `get_tags()` +- [ ] Network methods: `isolate()`, `rejoin()`, `is_isolated` +- [ ] Lifecycle methods: `delete()`, `seal()`, `unseal()` +- [ ] Event methods: `get_events()`, `get_timeline()`, `get_overview()` + +### 4.4 Hive +- [ ] `Hive(organization, hive_name, partition_key=None)` - Key-value store +- [ ] `HiveRecord` - Record with data, metadata, etag support +- [ ] Methods: `list()`, `get()`, `set()`, `delete()`, `validate()`, `rename()` +- [ ] Transaction support: `update_tx(callback)` with automatic etag retry +- [ ] Batch operations: `batch().get().set().delete().execute()` + +### 4.5 Search +- [ ] `Search(organization)` - LCQL query execution +- [ ] Methods: `validate()`, `estimate()`, `execute()`, `execute_streaming()` +- [ ] Iterator-based pagination for large result sets +- [ ] Progress callback support +- [ ] Saved query management: `list_saved()`, `get_saved()`, `create_saved()`, `delete_saved()` + +### 4.6 Spout (Real-time Streaming) +- [ ] `Spout(organization, data_type, filters=...)` - WebSocket streaming +- [ ] Configurable filters: investigation_id, tags, categories, sensor_ids +- [ ] Auto-reconnect with exponential backoff +- [ ] Queue-based buffering with configurable max +- [ ] Context manager: `with Spout(...) as spout: for event in spout: ...` +- [ ] Future results tracking for sensor tasking + +### 4.7 Configs (Infrastructure-as-Code) +- [ ] `Configs(organization)` - Configuration sync +- [ ] `fetch(components)` - Download current config +- [ ] `push(config, components, force=False, dry_run=False)` - Upload config +- [ ] `diff(config, components)` - Show differences +- [ ] Component selection: rules, fps, outputs, integrity, exfil, logging, artifacts, extensions, org_configs, hives, installation_keys, yara + +### 4.8 AI Generation (NEW) +- [ ] `AI(organization)` - AI-powered generation +- [ ] `generate_dr_rule(description)` - Generate D&R rule from natural language +- [ ] `generate_detection(description)` - Generate detection component +- [ ] `generate_response(description)` - Generate response component +- [ ] `generate_lcql(description)` - Generate LCQL query from natural language +- [ ] `generate_sensor_selector(description)` - Generate bexpr selector +- [ ] `generate_playbook(description)` - Generate Python playbook +- [ ] `summarize_detection(detection_data)` - Summarize a detection + +--- + +## 5. Command Groups & Commands + +### Organization Commands - `limacharlie org` +- [ ] `org info` - Get organization details (sensor count, version, quotas, name) +- [ ] `org list` - List accessible organizations (with --filter support) +- [ ] `org create --location [--template ]` - Create new org +- [ ] `org delete --confirm ` - Delete organization (two-step) +- [ ] `org rename ` - Rename organization +- [ ] `org config get []` - Get org configuration value(s) +- [ ] `org config set ` - Set org configuration value +- [ ] `org urls` - Get service URLs for organization +- [ ] `org quota set ` - Set sensor quota +- [ ] `org stats` - Get usage statistics +- [ ] `org errors [--dismiss ]` - List/dismiss org errors +- [ ] `org mitre-report` - Get MITRE ATT&CK coverage report +- [ ] `org schema [--event-type ] [--platform ]` - Get event schemas/ontology +- [ ] `org runtime-metadata [--entity-type ] [--entity-name ]` - Get runtime metadata +- [ ] `org check-name ` - Check if organization name is available + +### Sensor Commands - `limacharlie sensor` +- [ ] `sensor list [--selector ] [--limit ] [--online-only] [--with-ip ] [--with-hostname ]` - List sensors with rich filtering +- [ ] `sensor get ` - Get sensor details +- [ ] `sensor delete --confirm` - Delete sensor +- [ ] `sensor online ` - Check if sensor is online +- [ ] `sensor wait-online --timeout ` - Wait for sensor to come online +- [ ] `sensor upgrade [--selector ]` - Upgrade sensors to latest version across fleet +- [ ] `sensor set-version --version ` - Set sensor version/branch for organization +- [ ] `sensor export [--selector ]` - Export full sensor manifest as JSON/CSV +- [ ] `sensor dump --confirm` - Trigger full memory dump on sensor (DESTRUCTIVE/HEAVY) +- [ ] `sensor sweep --config ` - Run host sweep/scan on sensor + +### Tag Commands - `limacharlie tag` +- [ ] `tag list [--sensor ]` - List all tags or tags for a sensor +- [ ] `tag add [--ttl ]` - Add tag to sensor +- [ ] `tag remove ` - Remove tag from sensor +- [ ] `tag find ` - Find all sensors with a tag +- [ ] `tag mass-add --selector --tag [--ttl ]` - Bulk tag sensors +- [ ] `tag mass-remove --selector --tag ` - Bulk untag sensors + +### Endpoint Policy Commands - `limacharlie endpoint-policy` +- [ ] `endpoint-policy isolate --confirm` - Isolate sensor from network (DESTRUCTIVE) +- [ ] `endpoint-policy rejoin --confirm` - Rejoin sensor to network (DESTRUCTIVE) +- [ ] `endpoint-policy status ` - Check isolation status +- [ ] `endpoint-policy seal ` - Seal sensor +- [ ] `endpoint-policy unseal ` - Unseal sensor + +### Sensor Tasking Commands - `limacharlie task` +- [ ] `task send [--investigation-id ]` - Send task to sensor (fire-and-forget) +- [ ] `task request [--timeout ]` - Send task and wait for response +- [ ] `task reliable-send ` - Guaranteed delivery task +- [ ] `task reliable-list ` - List pending reliable tasks +- [ ] `task reliable-delete ` - Cancel reliable task + +### D&R Rule Commands - `limacharlie rule` +- [ ] `rule list [--namespace ]` - List D&R rules (namespace: general, managed, service) +- [ ] `rule get [--namespace ]` - Get rule details +- [ ] `rule create --detect --respond [--namespace ] [--enabled] [--ttl ] [--replace]` - Create/replace rule +- [ ] `rule create --input-file ` - Create rule from file +- [ ] `rule update --detect --respond [--namespace ]` - Update existing rule +- [ ] `rule delete [--namespace ]` - Delete rule +- [ ] `rule test --events [--trace]` - Test rule against sample events +- [ ] `rule replay --start