AI-Assisted InvestigationNew
On LimaCharlie, an AI agent investigating a detection has the same operational access as a human analyst: full telemetry, the detection engine, response actions, and case management, all through the API. Investigation agents query the evidence, reason through it, and produce a structured case with a risk verdict, and every step is logged.
Define the agent
From the AI Agents section of a tenant, describe the investigation in plain language: analyze processes, users, hosts, and related telemetry for signs of credential exfiltration, persistence, or lateral movement. The AI terminal is pre-loaded with LimaCharlie's telemetry schema and rule syntax, so the agent is grounded in your actual environment. Building one takes minutes, and the agent is saved as code.
Trigger it
A detection and response rule launches the agent whenever a matching detection fires. Agents can also run on a schedule or continuously in the background.
Investigate
The agent queries the relevant telemetry, correlates the detection against processes and history, and assesses the activity. In multi-agent setups, a triage agent groups related detections into a kill chain, hands the case to a deeper investigation agent, and escalates to a containment agent that can isolate the endpoint when the evidence warrants it.
Document
Findings land in LimaCharlie case management as a structured ticket: what was checked, what was found, and a risk verdict. Cases follow a defined lifecycle with SLA timestamps and an immutable audit trail, so you can see exactly what the agent did, when, and why.
Trust model
Agents run with scoped credentials under the same permission system as human operators, and how far they can act without approval is your decision, written in plain language.
Deploy your first sensor on the free community tier, or walk through it with a solutions engineer.
Start freeBook a demo