Building a bot takes five minutes. What it stands on took eight years. Introducing SOC Bots: Your AI teammates

Published October 1, 2026 · Updated November 2026

We shipped SOC Bots in LimaCharlie. You can create one in a few minutes: give it a role, pick a profile if you want one, and open a chat. Or skip the setup and start with a ready-made team. I said this during our September Build Log demo and I'll repeat it here, because everything else in this post follows from it. The bot is the easy part.

The better the models get, the more a bot's foundation decides what it can do. In security that effect is sharper than anywhere else, because a bot working in a SOC can act. Whatever sits underneath a bot gets amplified. On a closed stack, a smarter model produces smarter suggestions for a human to carry out. On an open foundation, the same model gets more work done inside the limits you set. Every model release widens that gap.

What SOC Bots do

One bot, one job

A SOC Bot starts as a role described in plain language, such as an OSINT researcher, a detection engineer, or a triage analyst. You can chat with it directly and shape as much of its definition as you like.

Routines

Ask a bot to do something on a schedule and it proposes a routine you can save. For example, have a morning report at 8am covering the past day's exploited high-profile CVEs and any breaches with good technical detail. The bot runs it daily and posts its findings in chat, so the research is waiting when your analysts log in.

Groups

Put several bots in a group chat and give one of them orchestration duties. A "chief of staff" bot can take a request like "check recent major CVEs against my tenant and suggest detections." It can send the research to the OSINT bot, give a scoping bot instructions to check exposure, and move the findings to a detection and response (D&R) rule builder once the data comes back. You'll end up with detection rules to review, edit, and download.

Group chat as an interface pattern is familiar to anyone who has used an AI tool this year. The results depend on what each bot can reach, and on how well the team is put together.

Teams built for how you run security

Pick from three ready-made teams, each with a coordinator and specialists that already know how to work together.

A team recommended for you

When you sign up, we ask if you run a service provider business. The matching team shows first, marked "Recommended for you."

A first task to start with

A new team's chat isn't empty. It offers four starter tasks for that team, such as estimating your monthly LimaCharlie cost for 10 customers or planning a side-by-side migration. A click fills the message box, and nothing runs until you send it.

Advice from our onboarding calls

The teams carry what we tell customers on onboarding calls, drawn from our public docs and pricing.

The service provider team covers what new providers usually miss. Price your own service and keep your brand on the invoice. Sell a predictable price with a usage allowance. Grow from EDR and SIEM into Email, Cloud, and App Control. Build your first customer org as a template and keep it as code with Git Sync. Give staff access through Organization Groups, ask for Unified Billing before your first customer, and turn on usage alerts and sleeper mode.

The in-house team runs LimaCharlie side by side with your current tools before you retire anything. It ingests your existing EDR's telemetry through adapters, keeps the full copy in LimaCharlie, and forwards only a slice to your SIEM. It converts and replays your existing rules, keeps prevention products like Defender in place, and plans around your contract renewals.

New to LimaCharlie

The SOC Bots launcher in the bottom-right corner greets first-time users with a short intro and a "Meet your SOC Bots" button. Once you've opened it, it steps back out of the way.

What SOC Bots stand on

Every function in LimaCharlie has been available through the API since we started building it in 2018, covering telemetry queries, detection and response rules, sensor tasking, case management, and tenant administration. We designed it that way for engineers who wanted to automate their own stack, and agents turned out to need exactly the same thing. When the scoping bot checks exposure, it queries real telemetry in your tenant. When the rule builder writes a detection, it produces the same D&R syntax your team already reads and deploys.

SOC Bots run as you

SOC Bots operate as your own user, so they carry your permissions and nothing more. A bot has no path into a tenant or capability you haven't been granted.

They ask before they act

Every bot works from your live org and the skills installed in it. It asks before changing anything, and it checks what uses a key before deleting it. Questions about discounts or contracts go to your account team.

Memory is readable

You can view and edit the memory of every bot and every group. When a bot's behavior drifts, you can see what it's carrying and correct it directly.

The output is yours

Rules the bots produce are standard LimaCharlie D&R rules. You can read, edit, version, and deploy them like anything else your team writes.

Bring your own model

SOC Bots work with LimaCharlie's managed AI, your own cloud subscription or API keys, or models you run on your own infrastructure. Everything the bots use is exposed through our CLI and documentation, so switching models leaves the foundation untouched. When a better model ships, your bots benefit as soon as you point them at it.

Where to start

Open SOC Bots, create the team recommended for you, and click one of its starter tasks. Then give one bot a routine for a job your team does every morning, and read what it produces for a week. If you don't have a tenant yet, create a free account and meet your SOC Bots. To see everything they can do, visit limacharlie.io/soc-bots.

The bots will get better every time the models do. We spent eight years making sure they'd have something worth standing on.