SecOps with Claude CodeNew
Because 100 percent of LimaCharlie is covered by API, Claude Code can operate the whole platform, and the LimaCharlie CLI gives it the same operational access as a human analyst. Describe the outcome in plain language, and the work gets done: sensors deployed, detection rules written and tested, telemetry hunted, tenants managed.
Connect
The integration needs a Linux system, a Claude Code account, a free LimaCharlie account, and about ten minutes. The LimaCharlie plugin installs with two short commands, with no custom infrastructure and no professional services engagement.
Operate in plain language
A prompt like “create a new org and install a sensor on this system, then verify it's connected” replaces several trips through a UI. Claude Code works through the steps, requests approval on each action, and confirms the result.
Engineer detections
Ask for a rule in natural language and get valid detection and response logic, tested against retained telemetry before deployment. Claude Code can also translate community rules into LimaCharlie's format and tune noisy rules down.
Hunt and investigate
Query a year of retained telemetry conversationally, from “summarize suspicious activity on this endpoint” to full retroactive hunts across tenants.
Scale it
Workflows can be codified as skills and run across every tenant an MSSP manages. Every action is logged and scoped to the permissions of the credential it runs under.
Cost
The integration is available on the free community tier, and AI runs against your existing Claude subscription rather than a separate platform fee. Supporting code lives in the open-source lc-ai repo.
Deploy your first sensor on the free community tier, or walk through it with a solutions engineer.
Start freeBook a demo