Iac

Infrastructure as Code

How to manage LimaCharlie configurations using git-based Infrastructure as Code, compatible with the ext-git-sync extension.

Repository Structure

my-lc-iac/
├── org-manifest.yaml              # Friendly name -> OID mapping
├── hives/                         # Global configs (all tenants)
│   ├── dr-general.yaml            # D&R rules
│   ├── fp.yaml                    # False positive rules
│   ├── outputs.yaml               # Output destinations
│   ├── extensions.yaml            # Extensions to enable
│   ├── integrity.yaml             # FIM rules
│   ├── artifact.yaml              # Artifact collection
│   ├── exfil.yaml                 # Exfil monitoring
│   ├── resources.yaml             # Resources/payloads
│   └── installation_keys.yaml     # Sensor install keys
├── orgs/                          # Per-tenant configs
│   └── <oid>/
│       ├── index.yaml             # Includes global + custom
│       └── custom/                # Tenant-specific overrides
│           ├── rules.yaml
│           └── fim.yaml
└── exports/                       # ext-git-sync exports

YAML Format

All config files use version 3 format:

version: 3
hives:
  dr-general:
    rule-name:
      data:
        detect:
          event: NEW_PROCESS
          op: contains
          path: event/COMMAND_LINE
          value: "-enc"
        respond:
          - action: report
            name: encoded-powershell
      usr_mtd:
        enabled: true
        expiry: 0
        tags: []

org-manifest.yaml

Maps friendly names to OIDs (ext-git-sync requires OID folder names):

version: 1
orgs:
  acme-corp:
    oid: 7e41e07b-c44c-43a3-b78d-41f34204789d
    description: "Acme Corporation - Production"
    added: "2025-11-30"

index.yaml (per org)

References global configs via relative includes, plus custom overrides:

version: 3
include:
  - ../../hives/extensions.yaml
  - ../../hives/dr-general.yaml
  - ../../hives/fp.yaml
  - ../../hives/outputs.yaml
  - ../../hives/integrity.yaml
  # Custom configs (uncomment as needed)
  # - custom/rules.yaml

ext-git-sync Setup

Subscribe

limacharlie extension subscribe --name ext-git-sync --oid <oid>

Configure

cat > /tmp/git-sync-config.yaml << 'EOF'
repo_url: "git@github.com:your-org/your-repo.git"
branch: "main"
conf_root: "orgs/<oid>/index.yaml"
ssh_key_source: "secret"
ssh_key_secret_name: "git-sync-ssh-key"
EOF
limacharlie extension config-set --name ext-git-sync --input-file /tmp/git-sync-config.yaml --oid <oid>

Required fields: repo_url (NOT repository), branch, conf_root, ssh_key_source, ssh_key_secret_name.

Store SSH Key

limacharlie secret set --key git-sync-ssh-key --input-file /tmp/ssh-key.txt --oid <oid>

Verify Setup

limacharlie extension list --oid <oid> --output yaml
limacharlie secret list --oid <oid> --output yaml
limacharlie extension config-get --name ext-git-sync --oid <oid> --output yaml
limacharlie org errors --oid <oid> --output yaml

Manual Sync (CLI)

Push (Local to Cloud)

limacharlie sync push --config-file ./orgs/<oid>/index.yaml --oid <oid> \
  --hive-dr-general --hive-fp --outputs --integrity --artifact --exfil \
  --resources --extensions --installation-keys

Avoid --force — it deletes cloud resources not present in the local config.

Pull (Cloud to Local)

limacharlie sync pull --oid <oid>

Importing Rules from LC

# List existing rules
limacharlie dr list --oid <oid> --output yaml

# Get a specific rule
limacharlie dr get --key <rule-name> --oid <oid> --output yaml

Add the fetched rule to hives/dr-general.yaml (global) or orgs/<oid>/custom/rules.yaml (tenant-specific).

Config Type Reference

Troubleshooting

Best Practices

• Use branches for changes, merge to main for deployment
• Let ext-git-sync handle deployment from main branch
• Never commit plaintext secrets — use hive://secret/<name>
• Test on one org before rolling out globally
• Use --dry-run on sync push before actual deployment