100+ CAPABILITIES & INTEGRATIONS

An ecosystem of powerful technologies

Get the security tools that your business needs on-demand. An ever-growing set of capabilities that can be used to automate and manage security operations at scale.

Get Started Free Book a demo

SCP

Forward events and detections over SCP (SSH file transfer).

Webhook (bulk)

Forward batches of events, detections, audits, deployments or artifacts through a POST webhook.

SMTP

Forward individually each event, detection, audit, deployment or log through an email.

Google Cloud BigQuery

Output events and detections to a Google Cloud BigQuery Table.

Slack

Monitor and write detections against Slack audit logs.

Syslog

Forward events and detections to a syslog target.

Google Cloud Pubsub

Forward events and detections to a Pubsub topic.

Google Cloud Storage

Forward events and detections to a GCS bucket.

Python CLI

Interact with Sensors in real-time and leverage advanced hunter capabilities.

REST API

Full-featured and well-documented REST API that enables full flexibility at scale.

Windows Event Logs

Monitor Windows Event Logs in real-time and write custom rules to detect malicious behavior.

Maxmind (IP Geolocation)

Write detection and response rules that use the users current geo location as a parameter.

Chronicle Backstory

The integration with Backstory will allow for the global correlation between log and endpoint telemetry.

Sensor Cull

Continuous cleaning of sensors that have not connected to your organization in a number of days.

PagerDuty

Trigger events within PagerDuty from LimaCharlie to streamline security operations.

MISP Lists

Leverage the world's largest open source threat intelligence platform.

Custom Threat Feeds

Bring in your own threat feeds using our simple integration model for lookups.

Marketplace

Create extensions and share them on the LimaCharlie marketplace for profit or for free.

Slack

Output detections and audit (only) to a Slack community and channel.

Microsoft Defender

Bring the logs from Defender for Endpoints or Defender for Cloud.

Torq

No-code Security Automation. Accelerate response, eliminate manual work, and deliver the best possible protection.

Custom Automation Rules

Scale your business by automating manual actions, processes, and workflows.

Microsoft Defender

Leverage the Defender integration to generate alerts and automate your security.

Responder

Automate the initial assessment after an incident using the sweep tool.

Memory/MFT Dumper

Perform deep forensics at scale using automated memory dumps.

Windows Event Logs

Collect WEL without deploying the LimaCharlie agent on the endpoint.

Github

Secure your CI/CD pipeline by ingesting and monitoring GitHub audit logs

Infrastructure as Code

Spin up new tenants with custom configuration using an infrastructure as code approach.

SnapAttack

Threat-informed cyber operations: advanced detection rules for any platform.

Custom Detection & Response Rules

Create complex detection logic to detect malicious behaviour specific to your use case.

Custom False Positive Rules

Reduce noise by easily creating false positive rules.

Report Detection

Report a detection to your security team across a multitude of channels.

Soteria Ruleset

Subscribe to a comprehensive privately managed detection ruleset .

Send Commands

Easily run commands on the endpoint through the web application or CLI.

Payloads

Run any executable or script on the endpoint on-demand or automatically across your fleet.

Telemetry Storage

One year of complete telemetry storage by default, at no extra cost.

Send Service Request

Perform asynchronous requests to any service a given organization is subscribed to.

Sigma Ruleset

Subscribe to a comprehensive detection rule set maintained by the Sigma open source community.

Forward to an Output

Easily forward the matched event to any external source via the Output functionality.

Isolate From the Network

Isolate any endpoint from the network while maintaining a line of command and control.

Event Tree View

Shorten investigation time by leveraging the visual tree view in LimaCharlie's web app.

Role-Based Access Control

Advanced role-based access (RBAC) and fine grained permissions makes managing users easy.

Platform Logs

Everything that takes place in LimaCharlie is captured in management, error, and audit logs.

Sensor Actions

Take actions towards remediation (kill processes, isolate from the network, and more).

Tines

Leverage the Tines no-code security automation platform to automate your security workflows.

Twillio

Trigger Twilio alerts based on detection & response rules.

VirusTotal

Make VT part of your detection & response rules to automate response in real-time.

Custom Branding

Customize the LimaCharlie web application for your brand with your logo, colors and domain address.

1Password

Automatically ingest and monitor 1Password event logs.

Carbon Black

Automatically ingest and monitor Carbon Black EDR logs & telemetry.

Historical Threat Hunting

Easily run detection & response rules against historical telemetry.

IOC Search

Search for indicators of compromise across your entire fleet over the last year.

Google Cloud Platform

Automatically ingest and monitor Google Cloud Platform audit logs.

File Integrity Monitoring

Automate integrity checks of files & registry values through pattern-based rules.

External Logs

Automatically ingest and monitor logs from any source.

Docker

Real-time telemetry collection, alerting and remediation in the cloud.

Multitenancy

True multitenancy makes scaling operations simple and efficient.

Crowdstrike

Automatically ingest and monitor Crowdstrike EDR logs & telemetry.

Duo

Automatically ingest and monitor Duo event logs in real-time.

Microsoft Office 365

Bring Microsoft Office 365 logs into LimaCharlie.

YARA Scanning

Run scans on demand or continuously across the entire fleet without impacting performance.

Query Console

Flexible, intuitive, and interactive way to explore data in LimaCharlie.

Windows

Real-time telemetry collection, alerting and remediation on the Windows endpoints.

Single Sign On

Allows a user to log in with a single ID to any of several related, yet independent, software systems.

Sensor Grouping

Group sensors with tags for automation and remediation at scale.

Sensor Commands

Interact with a sensor's host for investigation, management, or threat mitigation purposes.

Microsoft Edge

Real-time telemetry collection, alerting and remediation in the Edge browser.

Lookups & Threat Feeds Library

Subscribe to a number of threat feeds each at the click of a button.

macOS

Real-time telemetry collection, alerting and remediation on the macOS endpoints.

Linux

Real-time telemetry collection, alerting and remediation on the Linux endpoints.

Webhook

Forward individually each event, detection, audit, deployment or artifact through a POST webhook.

Reliable Tasking

Task a sensor (or set of sensors) that are currently offline.

SFTP

Forward events and detections to any external source over SFTP.

Velociraptor

Targeted collection of digital forensic evidence across your endpoints.

User Groups

Manage staff at scale using group permissions.

Kubernetes

Real-time telemetry collection, alerting and remediation in the cloud.

Apache Kafka

Forward events and detections to a Kafka target.

Amazon S3

Forward events and detections to an Amazon S3 bucket.

Centralized Billing

Set one billing for all organizations created by members of your domain.

Chrome

Real-time telemetry collection, alerting and remediation in the Chrome browser.

Artifact Collection

Automatically ingest and monitor logs or artifacts from any endpoint.

Atomic Red Team

Automate testing against the MITRE ATT&CK framework at scale.

Custom Rulesets

Create your own custom ruleset to use across your organizations.

AWS Cloudtrail

Automatically ingest and monitor AWS Cloud Trail logs.

AlienVault OTX

Continuously import all your Open Threat Exchange pulses and the relevant D&R rules.

Zeek Network Security Monitor

Run the Zeek tool on ingested PCAPs for network traffic analysis.

Data Sovereignty

Control in which GCP region you want your data to be processed and stored.

Cisco Talos Blocklist

Write detection & response rules that check against the Cisco Talos IP blocklist.

Abuse.ch Lists

Leverage this list of cyber threats with a strong focus on malware and botnets.