onboard-new-org

# Onboard New Organization

A comprehensive onboarding wizard that discovers cloud infrastructure, identifies assets for monitoring, and guides through EDR deployment and log source integration for LimaCharlie organizations.

---

## LimaCharlie Integration

> **Prerequisites**: Run `/init-lc` to initialize LimaCharlie context.

### API Access Pattern

All LimaCharlie API calls go through the `limacharlie-api-executor` sub-agent:

```
Task(
  subagent_type="lc-essentials:limacharlie-api-executor",
  model="sonnet",
  prompt="Execute LimaCharlie API call:
    - Function: <function-name>
    - Parameters: {<params>}
    - Return: RAW | <extraction instructions>
    - Script path: {skill_base_directory}/../../scripts/analyze-lc-result.sh"
)
```

### Critical Rules

| Rule | Wrong | Right |
|------|-------|-------|
| **MCP Access** | Call `mcp__*` directly | Use `limacharlie-api-executor` sub-agent |
| **LCQL Queries** | Write query syntax manually | Use `generate_lcql_query()` first |
| **Timestamps** | Calculate epoch values | Use `date +%s` or `date -d '7 days ago' +%s` |
| **OID** | Use org name | Use UUID (call `list_user_orgs` if needed) |

---

## When to Use

Use this skill when:

- **Setting up a new LimaCharlie organization**: Full onboarding of cloud infrastructure
- **Connecting cloud platforms**: GCP, AWS, Azure, DigitalOcean, or other cloud providers
- **Deploying EDR to cloud VMs**: Mass deployment of LimaCharlie agents
- **Onboarding hybrid environments**: Mix of cloud VMs and log sources
- **Expanding monitoring coverage**: Adding new cloud projects or accounts

Common scenarios:
- "I want to onboard my AWS environment to LimaCharlie"
- "Set up monitoring for all my GCP VMs"
- "Connect my Azure audit logs and deploy EDR to my VMs"
- "I have a new organization, help me set everything up"
- "What can I monitor from my cloud infrastructure?"

## What This Skill Does

This skill performs a complete onboarding workflow:

1. **Organization Selection**: Select