Your home lab just got cloud and email: LimaCharlie's expanded free Community tier

LimaCharlie's free Community tier now covers cloud and email security alongside the endpoint sensor. A free organization can connect cloud accounts and identity providers for posture and attack surface findings, and it can protect up to 10 mailboxes at no charge with no time limit. Those mailboxes can be personal Gmail or any IMAP account, so you no longer need a Google Workspace or Microsoft 365 tenant to practice email security at home.

For years, LimaCharlie has been the EDR in a lot of home lab tutorials. People install the sensor on a Windows VM, run an attack against it on purpose, and learn to write detection rules against what the telemetry shows them. That lab still works and is still free. What changes is how much of an attack you can see in one place: a phishing message, the cloud account it targets, and the process it spawns on an endpoint can now land in the same telemetry, under the same rules, in an organization you pay nothing for.

The labs that put LimaCharlie in home environments

Eric Capuano's So You Want to Be a SOC Analyst series, published in February 2023, let aspiring analysts skip weeks of plumbing and get straight to analyst work. Learners attacked their own Windows VM with the Sliver C2 framework from an Ubuntu box, watched the activity show up in LimaCharlie, wrote detection rules, blocked the attack, tuned false positives, and triggered YARA scans from a rule. The series now has a cloud-hosted 2.0 version.

Dr. Gerald Auger of Simply Cyber recorded a full walkthrough of Eric's series, and for many people that video was their first look at an EDR console. The MyDFIR YouTube channel went further with a SOAR-EDR project that passes LimaCharlie detections through Tines to Slack and email, with a step that asks the analyst whether to isolate the machine.

All three labs taught endpoint detection and response on one or two hosts, which was everything the free tier covered at the time.

What the free tier includes now

An organization stays on the free tier as long as its sensor quota is 2 or less. There is no trial period and no expiry.

The Cloud Security free tier page has the details. When a connection would push the organization over a limit, it is paused; nothing is deleted, and each connection syncs completely or not at all.

Email Security reads mail through the provider's API or over IMAP, so nothing about delivery changes. Every message gets a verdict of malicious, suspicious, graymail, or benign, and every verdict that isn't benign lists the signals and weights behind it. Every message and verdict becomes an event, the same as all other telemetry in LimaCharlie, so EMAIL_MESSAGE and EMAIL_VERDICT events sit next to your endpoint and cloud data and can be matched by ordinary detection and response rules.

Build the lab, step by step

This build takes an afternoon and costs nothing on the LimaCharlie side. It keeps the shape of Eric's original lab (a victim machine and an attacker machine) and adds a cloud account and two inboxes: a burner Gmail address for test messages and your own inbox as a mailbox you protect. Use a dedicated cloud account for anything you plan to misconfigure.

1. Create your organization

Sign up at app.limacharlie.io and create an organization, which is an isolated tenant with a globally unique name. Pick the region carefully, because it is permanent. Leave the sensor quota at 2 or less to stay on the free tier. If you would rather have an AI assistant do the setup, the docs cover setting up LimaCharlie with Claude or Codex through the LimaCharlie CLI.

2. Deploy the endpoint sensor

On the Sensors page, add a Windows sensor, create an installation key (it ties the sensor to your organization), and run the 64-bit installer. Once the sensor registers, open it: Timeline, Processes, File System, Console, and Live Feed are where you will spend most of your time. Put the second sensor on the Linux VM if you want Linux telemetry. If antivirus on the VM interferes with the install, see the Quickstart.

3. Turn on baseline detections

Enable the free Sigma add-on, which applies the open SigmaHQ signatures to your telemetry and keeps them up to date. You have detections before writing a single rule.

4. Connect a cloud account

In Cloud Security, add a connection for AWS, Google Cloud, or Azure. On the free tier each connection names a single account, project, or subscription. Connections are evaluated in alphabetical order by name, so give your most important one a name that sorts first. Once the sync completes, open Findings and the security graph.

5. Protect a Gmail or IMAP mailbox

Subscribe the organization to the Email Security extension. For a personal Gmail account:

1. Turn on 2-Step Verification for the Google account.

2. Create an app password at myaccount.google.com/apppasswords and copy it. Google shows it only once.

3. Store the app password as a secret in LimaCharlie, one secret per mailbox.

4. Add an IMAP connection that lists each mailbox, then test the connection.

Automations ship in alert-only mode, so nothing is moved or bannered until you switch a policy to enforce. Leave it that way while you learn. Mail that a Gmail filter moves out of the Inbox is not covered, so check your filters. The IMAP setup guide has the full steps, including the CLI version (5.7.0 or later).

6. Send yourself a test message

From another account, send the burner Gmail a labelled test message with a link to a newly registered domain or a zipped attachment. Open the message in LimaCharlie and read which signals fired and how much each one weighed. Then quarantine it (forcing the action while in alert-only mode) and check that it moved to the LC Quarantine label in Gmail.

What to practice once it is running

On the endpoint, run Eric's original sequence: drop a Sliver implant, find it in Processes and Timeline, write a rule for the behavior, block it, and tune out the false positives. The D&R rule building guidebook covers the syntax.

In the cloud account, create a storage bucket with public access or an IAM user with far more permissions than it needs. Wait for the next sync, find the finding, follow the attack path in the security graph, fix it at the provider, and confirm the finding clears. If you connect a GitHub account, Code Security scans your first 10 repositories.

For email, write a custom mail rule for something the managed rules don't weigh heavily in your inbox. Mirror a public threat feed into a lookup with the IOC and reputation feeds guide and send yourself a link from it.

The exercise the older labs could not offer is the one that crosses sources. The Email Security docs describe the rule it enables: a phish was delivered, and then that user's endpoint ran a new binary. Click your own test link from the Windows VM and work out how to catch it. The Events and Automation guide shows how email events reach your rules.

If you run an AI agent that works on its own computer, such as a Grok Bot, put your second sensor there instead and watch every command it runs and connection it opens. The Securing Grok Bot tutorial walks through it. You can also point an AI assistant at your organization through the LimaCharlie CLI and have it triage the alerts your lab generates, across endpoint, cloud, and email.

Show us your lab

If you already have a free organization from an earlier lab, you have all of this too, as long as your sensor quota is 2 or less. Questions go to the LimaCharlie community, where other home lab builders and the LimaCharlie team answer them.

If you write, stream, or teach, we want to see what you build. The labs from Eric, Gerald, and MyDFIR taught a lot of people EDR, and we would like the next generation of labs to cover the inbox and the cloud account as well. Publish your build and tag LimaCharlie. If you're a content creator interested in partnering on lab guides, reach out to charlton@limacharlie.com.

Try LimaCharlie free today. Just sign up for the free Community tier.