October 4th, 2023
Developer Roll Up: September 2023

Christopher Luft

September was a busy month for the team at LimaCharlie. We hosted a webinar, attended Texas Cyber Summit, and were heads-down getting ready for MSSN CTRL.
Upcoming Events
MSSN CTRL
The inaugural MSSN CTRL security engineering and automation conference is taking place on October 5th & 6th in Arlington, VA. There is a great lineup of speakers talking about innovative practices and how they are changing the way security has been traditionally practiced for the past decade. We will be recording the talks and will be making them public for those who cannot attend in person. Sign up to be notified when the session recordings are published.
Live webinar: Detect malicious files with BinLib: a private binary library
Join us on October 18 when we look at one of LimaCharlie’s newest features: Binary Library, or “BinLib”, a private repository of binaries observed in an organization. BinLib opens up new opportunities for detecting malicious files within an organization. Historical searching and YARA scanning allow you to take your binary detection to the next level, as we will observe and discuss in this session. Register now
MSSP Alert Live
The team will be at MSSP Alert Live on October 9-11 in Washington, D.C. Stop by our table if you plan on making it to the event–we’d love to see you! Interested in attending but don’t have a ticket? Contact Jessica Cryzter in our community Slack channel and we may be able to help you out with a ticket.
Past Events
If you missed or would like to re-watch our recent webinar, Using Scheduled Detection & Response Rules, you can watch the recording on our YouTube channel. Matt Bromiley walked through how to use scheduled D&R rules to automate platform operations, administration, and data-gathering opportunities using LimaCharlie.
Product Updates
Changes to the Billing & Usage page
In this release, we have implemented some long-anticipated changes to the Billing & Usage page. You can now see the details of upcoming invoices for your LimaCharlie tenants. This information is pulled dynamically from Stripe so you can follow the changes to your invoice throughout the billing period.
In line with these changes, the Metered Usage section of the page is now only focused on usage stats.
File & Registry Integrity Monitoring Extension
Following the launch of Extensions, we are porting all LimaCharlie Services into the corresponding Extensions. We recently released the File & Registry Integrity Monitoring Extension, which means you can migrate the legacy File & Registry Integrity Monitoring Service to the new Extension.
To get started with migrating the existing tenant, navigate to the Integrity Service, select the organization, and follow the steps on the screen. You can also do it from the Service page within your tenant.
If you are creating a new organization, you can subscribe to the Integrity Extension right away, without having to first enable the Integrity Service: https://app.limacharlie.io/add-ons/extension-detail/ext-integrity
Please do not hesitate to reach out if you have any questions.
Upcoming Infra as Code Tweak
An upcoming version of the LimaCharlie CLI (part of the Python SDK) will include an added level of validation.
Missing "imported" files from infra-as-code configurations will now generate Exceptions. If your config is importing a file, and that file does not exist, the Push will fail.
This does not apply to imported files with wildcards (* and ?) which will keep working as-is.
The intended change is to make infra pushes more reliable by immediately flagging potentially broken configs.
Announcing Kubernetes Pods Logs Adapter
This Adapter collection method allows you to collect the logs of all the Pods in a Kubernetes cluster and bring them in LimaCharlie. The container we publish makes this extra easy to add onto an existing cluster.
Documentation: https://docs.limacharlie.io/docs/kubernetes-pods-logs
Container def: https://github.com/refractionPOINT/usp-adapters/tree/master/containers/k8s_pods
Public container: https://hub.docker.com/r/refractionpoint/lc-adapter-k8s-pods