Integrated Email Security with LimaCharlie: Hands-On Workshop for MSSPs

Most MSSPs operate email security in a silo, separate from the endpoint and identity telemetry they monitor for each client. LimaCharlie's new Email Security capability changes this by protecting every client's Microsoft 365 and Google Workspace mailboxes directly within a single multi-tenant platform. Connecting via API without MX changes or delivery disruption, it assesses delivered messages, executes audited remediations, and outputs events into each client's unified stream, enabling cross-domain detection in a single D&R rule.

In this hands-on workshop, Sr. Solutions Engineer Ken Westin walked through:

• •Connecting a live mail tenant
• •Analyzing incoming messages
• •Creating custom signal and correlation rules
• •Automating policy responses
• •Integrating IOC feeds
• •Managing these configurations as code for easy reuse across client orgs

Follow along with the course and lab guide.