Feedback

Feedback — Human-in-the-Loop Requests

Send interactive feedback requests to humans through configured channels and dispatch responses to cases, playbooks, or AI agents.

LimaCharlie Integration

Prerequisites: Run /init-lc to initialize LimaCharlie context.

LimaCharlie CLI Access

All LimaCharlie operations use the limacharlie CLI directly:

limacharlie <noun> <verb> --oid <oid> --output yaml [flags]

For command help and discovery: limacharlie <command> --ai-help

Critical Rules

When to Use

Use this skill when you need to:

• Ask for approval before taking a high-impact action (isolate host, block IOC)
• Notify and acknowledge — send an alert and wait for someone to confirm they saw it
• Collect input — ask an analyst a free-form question during an investigation
• Gate automated workflows — pause a playbook or AI agent until a human responds

Prerequisites

The organization must have:

1. ext-feedback subscribed — check with limacharlie extension list --oid <oid> --output yaml | grep ext-feedback
2. At least one channel configured — check with limacharlie feedback channel list --oid <oid> --output yaml

If either is missing, tell the user and suggest running /init-feedback to set things up.

Request Types

1. Approval (Approve / Deny)

Presents two buttons. Best for gating actions.

limacharlie feedback request-approval \
  --channel <channel_name> \
  --question "Isolate sensor web-prod-03 (sid abc123)?" \
  --destination case --case-id <case_number> \
  --oid <oid> --output yaml

Optional flags:

• --approved-content '{"action":"isolate","sid":"abc123"}' — JSON payload sent when approved
• --denied-content '{"action":"skip"}' — JSON payload sent when denied
• --timeout 300 --timeout-choice denied — auto-deny after 5 minutes

2. Acknowledgement

Single Acknowledge button. Best for notifications.

limacharlie feedback request-ack \
  --channel <channel_name> \
  --question "Alert: lateral movement detected on host-01" \
  --destination case --case-id <case_number> \
  --oid <oid> --output yaml

Optional flags:

• --acknowledged-content '{"status":"seen"}' — JSON payload on ack
• --timeout 600 — auto-ack after 10 minutes
• --timeout-content '{"status":"auto-acked"}' — override payload for timeout

3. Question (Free-Form Text)

Text input field. Best for collecting analyst input.

limacharlie feedback request-question \
  --channel <channel_name> \
  --question "What is the root cause of incident #42?" \
  --destination case --case-id <case_number> \
  --oid <oid> --output yaml

Optional flags:

• --timeout 300 — auto-answer after timeout (requires --timeout-content)
• --timeout-content '{"answer":"no response"}' — automatic answer on timeout

Destinations

The --destination flag controls where the response goes:

ai_agent destination: ext-feedback also supports ai_agent as a destination (starts an AI session with the response data). This destination is available through D&R rule extension requests but not yet in the CLI. To use it, generate a D&R response with limacharlie ai generate-response that sends an extension request to ext-feedback with feedback_destination: ai_agent and ai_agent_name: <name>.

Workflow

Step 1: Verify Prerequisites

limacharlie extension list --oid <oid> --output yaml | grep ext-feedback
limacharlie feedback channel list --oid <oid> --output yaml

If ext-feedback is not subscribed or no channels exist, stop and suggest /init-feedback.

Step 2: Choose the Right Request Type

Step 3: Send the Request

Pick the appropriate command from the Request Types section above. Always include:

• --channel — the configured channel name
• --question — clear, actionable prompt text
• --destination and its required companion flag
• --oid

Step 4: Handle the Response

• case destination: The response appears as a case note. Query it with limacharlie case get --case-number <N> --oid <oid> --output yaml.
• playbook destination: The playbook runs automatically with the response payload.
• Web channel: The CLI response includes a url field — share it with the user so they can respond via the web UI.

Timeout Behavior

Timeouts prevent indefinite hangs in automated workflows:

Minimum timeout is 60 seconds. Feedback requests expire after 7 days regardless.

Channel Management

List, add, or remove channels:

# List channels
limacharlie feedback channel list --oid <oid> --output yaml

# Add a web channel (no credentials needed)
limacharlie feedback channel add --name web --type web --oid <oid> --output yaml

# Add a Slack channel (requires a Tailored Output with slack_api_token + slack_channel)
limacharlie feedback channel add --name ops-slack --type slack --output-name my-slack-output --oid <oid> --output yaml

# Remove a channel
limacharlie feedback channel remove --name old-channel --oid <oid> --output yaml

Channel types: web, slack, telegram, ms_teams, email. All non-web types require a Tailored Output holding credentials. Use /init-feedback for guided channel setup.

Examples

Gate Host Isolation on Approval

limacharlie feedback request-approval \
  --channel ops-slack \
  --question "Case #17: Isolate sensor db-prod-01 (sid 8a3f...)?" \
  --destination case --case-id 17 \
  --approved-content '{"action":"isolate","sid":"8a3f..."}' \
  --denied-content '{"action":"skip"}' \
  --timeout 300 --timeout-choice denied \
  --oid <oid> --output yaml

Notify SOC of Critical Alert

limacharlie feedback request-ack \
  --channel ops-slack \
  --question "CRITICAL: Ransomware indicators detected on FILESERVER-01. Case #42 opened." \
  --destination case --case-id 42 \
  --timeout 600 \
  --oid <oid> --output yaml

Ask Analyst for Root Cause

limacharlie feedback request-question \
  --channel web \
  --question "What is the likely initial access vector for case #42?" \
  --destination case --case-id 42 \
  --oid <oid> --output yaml

Related Skills

• /init-feedback — Set up ext-feedback: subscribe, configure channels, create sample D&R rules
• /detection-engineering — Create D&R rules with feedback approval gates
• /investigation-creation — Investigate cases (feedback responses land as case notes)