[New] Introducing Email Security: Natively integrated into your SecOps Stack [Read release]
NewReady-made teams for service providers and in-house SOCs →

Your SOC team, ready in five minutes.

A triage analyst, a threat hunter, a detection engineer, and a Chief of Staff to run them. SOC Bots work inside LimaCharlie on your real telemetry, with your permissions and nothing more.

LimaCharlie
SOC BotsORGANIZATION ▾
Create bot
Import bot
Create group
Routines
Quick SearchCtrl K
Groups1
LimaCharlie Control Room
6 bots
My bots6
MailSec Investigator
Investigates email threats and operat…
CloudSec Cartographer
Maps cloud assets, identities, expos…
LCQL Hunter
Hunts across LimaCharlie telemetry …
D&R Rulesmith
Builds, tests, and tunes D&R rules …
Sensor Fleet Operator
Operates the LimaCharlie sensor fle…
Chief of Staff
Working…
Chief of StaffWorking
Turns the user’s intent into a plan, delegates it to the specialists, and delivers the outcome.
Check last night’s exploited CVEs against our tenant and suggest detections.
Chief of Staff7:02 AM
Delegated to 3 specialists
LCQL Hunter· Querying 30 days of telemetry for 3 exploited CVEs
Sensor Fleet Operator· Confirming sensor coverage on affected hosts
D&R Rulesmith· Waiting on findings to draft detections
Chief of Staff7:19 AM
ResultComplete
Two hosts run a vulnerable build. I drafted 2 D&R rules and nothing is deployed yet:
detect-cve-2026-exploit-chain.yaml · 2 hosts in scope
detect-suspicious-child-of-webserver.yaml · fleet-wide
Open execution inspector
Reply
Make this recurring
On it. Querying 30 days of telemetry.
Routine saved
Every day at 08:00 · CVE morning report

Simple setup. Three clicks.

01

Pick a team

02

Click a starter task

03

Review the result

Every bot gets one job. They’re very good at it.

A SOC Bot starts as a role described in plain language. Chat with it directly, shape its definition, and put it to work on your tenant.

Chief of Staff

Splits the work and keeps the group on track.

Triage Analyst

Sorts alerts so the real ones surface first.

I hunt things.

Threat Hunter

Looks for what your rules haven’t caught yet.

Detection Engineer

Writes D&R rules you can read and deploy.

OSINT Researcher

Tracks exploited CVEs and fresh breaches.

Business Advisor

Prices your service and plans your rollout.

Migration Specialist

Runs LimaCharlie side by side with your stack.

Or describe any role you need, and build your own.

Give it a job. Give it a schedule. Give it a team.

01 / One bot, one job

Describe a role. Pick a face.

A SOC Bot starts as a role in plain language. Give it a job, choose a character and a color, and open a chat. Shape as much of its definition as you like.

  • Plain-language roles
  • Optional profiles for common jobs
  • Chat with it directly
Create bot

Name

Detection Engineer

Responsibility

Turn new threat research into D&R rules. Test them against 30 days of telemetry, then send them to me for review.

Choose an avatar

Scout
Sage
Spark
Guard
Pilot
Maker
Signal
Rescue
Surprise me
CancelCreate bot
Ooh, teal. Good choice.

02 / Routines

Ask once. It runs every morning.

Ask a bot to do something on a schedule and it proposes a routine you can save. It runs on time and posts its findings, so the research is waiting when your analysts log in.

  • Proposed by the bot, saved by you
  • Daily, weekly, or custom schedules
  • Findings posted to chat
Make this recurring
Want me to run this every weekday at 08:00 and post to #morning-standup?

Task

Report the past day’s exploited high-profile CVEs and any breaches with good technical detail.

Repeats

Every weekday

At

08:00 (your time)

Next runs

Thu 08:00
Fri 08:00
Mon 08:00
Not nowSave routine

z z z

03 / Groups

Put a few bots in a room. Watch them hand off.

Give one bot orchestration duties and it splits the request across specialists. They pass work between themselves and come back with detection rules to review, edit, and download.

  • A coordinator that delegates
  • Specialists that hand off work
  • Up to 6 bots per group
LimaCharlie Control Room
6 bots · group
Chief of Staff7:02 AM
Three CVEs from last night have public exploits. LCQL Hunter, check our telemetry. Sensor Fleet Operator, confirm coverage.
Chief of Staff gave the task to LCQL Hunter
LCQL Hunter7:11 AM
2 hosts ran the vulnerable build in the last 30 days: web-03 and web-07. D&R Rulesmith, it’s yours.
LCQL Hunter handed off to D&R Rulesmith
D&R Rulesmith7:19 AM
Drafted and tested against 30 days of telemetry. Zero false positives. Nothing deploys until you approve.
detect-cve-2026-exploit-chain.yamlReview

04 / Runs as you

Every step, in the open.

Bots operate as your own user, with your permissions and nothing more. Open the execution inspector to see every call a bot made, and read or edit what it remembers.

  • Your permissions, nothing more
  • Asks before changing anything
  • Readable, editable memory
Execution inspector · D&R Rulesmith
Running as you
search.query30 days · 2 hosts matched1.8s
dr_rules.validatedetect-cve-2026-exploit-chain0.4s
replay.run0 false positives over 30 days6.2s
dr_rules.deployWaiting for your approval—
Edit ruleApprove deploy
Updated memory for Chief of Staff
web-07 is a honeypot. Leave it out of exposure counts.
EditForget
Your call. I’ll wait.

Start with a team built for how you run security.

Each team comes with a coordinator and specialists that already know how to work together.

Recommended for you

Service provider

For MSSPs, MSPs, MDR, and IR firms

  • Practice LeadCoordinator
  • Business Advisor
  • Billing Specialist
  • Tenant Onboarding Engineer
  • Multi-Tenant Detection Engineer
  • SOC Analyst

In-house security

For enterprise, mid-market, and public-sector teams

  • Security LeadCoordinator
  • Migration Specialist
  • Deployment Engineer
  • Detection & Response Engineer
  • Threat Hunter
  • Budget & Compliance Advisor

Platform specialists

For anyone who wants a guide to each part of LimaCharlie

  • Chief of StaffCoordinator
  • EDR specialist
  • SIEM specialist
  • Email specialist
  • Cloud specialist
  • …and one bot per product

From signup to first answer in a few clicks.

01

Pick your team

Create the team recommended for you, or any of the three. Each card checks your free bot slots first.

02

Click a starter task

A new team’s chat offers four starter tasks. A click fills the message box.

03

Review, then send

Nothing runs until you send it. Bots ask before changing anything in your org.

# service-provider-team

Your team is ready. Where should we start?

→Estimate my monthly LimaCharlie cost for 10 customers…
→Build my first customer org as a template…
→Set up staff access with Organization Groups…
→Turn on usage alerts before my first customer…
Estimate my monthly LimaCharlie cost for 10 customers…Send
Nothing runs until you hit send.

Cute on the outside. Eight years of API underneath.

Every function in LimaCharlie has been available through the API since 2018. When a bot checks exposure, it queries real telemetry. When it writes a detection, it’s the same D&R syntax your team already deploys.

Runs as you

Bots operate as your own user, with your permissions and nothing more. No path into a tenant you haven’t been granted.

Asks before it acts

Every bot asks before changing anything, and checks what uses a key before deleting it.

Memory you can read

View and edit the memory of every bot and group. If behavior drifts, see what it’s carrying and correct it.

Output that’s yours

Rules are standard LimaCharlie D&R rules. Read, edit, version, and deploy them like anything your team writes.

Bring your own model

Use your own cloud subscription, API keys, or models on your own infrastructure.

Better with every model

Switching models leaves the foundation untouched, so your bots improve as soon as you point them at a better one.

Questions, answered by a human.

What is a SOC Bot?

An AI teammate that works inside LimaCharlie. You give it a role in plain language, chat with it, schedule routines, and group it with other bots.

What can a bot access?

Only what you can. Bots operate as your own user, with your permissions and nothing more, so there’s no path into a tenant you haven’t been granted.

Will a bot change things without asking?

No. Every bot asks before changing anything in your org, and nothing it drafts is deployed until you approve it.

Which models can I use?

Your own: a cloud subscription, API keys, or models on your own infrastructure. Switching models leaves the foundation untouched.

How many bots can I run?

A group holds up to 6 bots. When you create a team, the card checks your free bot slots first.

I run an MSSP. Is there a team for me?

Yes. The Service provider team is built for MSSPs, MSPs, MDR, and IR firms, with a Practice Lead coordinating a Business Advisor, Billing Specialist, Tenant Onboarding Engineer, Multi-Tenant Detection Engineer, and SOC Analyst.

✓2 rules ready for review
RoutineCVE report · 08:00

Your team is waiting.

Your analysts get the morning report. Your detection engineers get draft rules. You get the final say.

Create a free account, open SOC Bots, and say hello.