Developer Roll Up: October 2022

The team at LimaCharlie continues to roll out new features and improvements with no end in sight. We are adding more support for different kinds of data ingestion and deploying lots of quality-of-life improvements.

We are also thrilled to be launching The Cybersecurity Defenders Podcast - a new show about cybersecurity and the people who defend the internet. We'll be featuring many of the familiar faces you see in this community and we're definitely going to have some fun with this. Check out the first few episodes already published. Comments/suggestions/feedback welcome as we dive into this new venture.

Subscribe and listen to the podcast on Apple Podcast (or in your other preferred podcast apps) Subscribe to the newsletter format on LinkedIn

CrowdStrike sensor

LimaCharlie continues to expand the list of telemetry sources we support. We added a new CrowdStrike sensor enabling users to ingest CrowdStrike EDR events normalized to LimaCharlie format.

This allows you to bring in all of your security data into LimaCharlie, write detections on this data, take advantage of our 1 year data storage, and send what you need to the destinations of your choice via Outputs.

CrowdStrike sensor is billed based on usage ($0.15 / GB).

Billing for deploying payloads

As previously announced, starting today deploying Payloads via LimaCharlie is priced at $0.19 per 1 GB of data sent. For example, a 1GB payload sent to 10 endpoints will cost $1.9 (10GBs x $0.19).

This change will only impact organizations that leverage Payloads functionality, as well as Atomic Red Team, LimaCharlie Net installers & Dumper services (they are running as Payloads in LC). To understand the impact on your organization, check the Metered Usage section of the Billing page. You will notice the “Payload Data Sent” metric along with the size of payloads deployed and price.

The reasoning for this update is that as of October 1, 2022, Google Cloud has started billing on outbound bandwidth from load balancers. As LimaCharlie is on GCP, we’re adjusting our pricing accordingly.

Adapter 1.13.0: file source

The LimaCharlie Adapter now supports a file source which has a file_path parameter pointing to a file to tail. It also supports a no_follow option which will make the Adapter load the file as it is on disk and stop after it has done loading.