LimaCharlie provides information security tools and infrastructure designed for massive scale. The platform supplies all the tools to run an MSSP or SOC as well as providing API’s that allow users to build and monetize their own products.

Developer documentation can be found here.

The REST API Documentation can be found here.

## Quickstart

To skip all of the details and get set up with endpoint detection and response capability you can follow our quick start instructions or take the equivalent e-learning course.

## Feedback & Feature Requests

If have feedback or would like to make a feature request please fill out the form here.

# Products LimaCharlie.io Logo

## EDR/XDR The LimaCharlie sensor is fully interactive and can monitor over 70 different event types. The agent is written in C and then compiled for each different platform and architecture it runs on which means is that it has true feature parity across all operating systems. A detailed overview can be found here. * Architecture & OS Support * Live View * Installing the Agent * Connectivity LimaCharlie.io Logo

## Net

LimaCharlie Net is a Secure Access Service Edge (SASE) that rolls SD-WAN into a cloud service. It changes the way that secure remote access is delivered. It is much more than a virtual private network and can be established with the click of a button. It is a micro-segmentable network that can capture full or partial PCAP files entirely in the cloud without impacting users. These captured files can also be analyzed with the Zeek Network Monitoring Tool and have detection rules written against them.

* Firewall * Full/Partial Cloud Packet Capture * Dynamic Internal DNS * Dynamic Internal Service Access LimaCharlie.io Logo

## Comms Comms is the place to respond to detections as a team. It's built close to the metal to give you full visibility of the actions your team is taking to mitigate any threats. It all starts when a detection happens - a Room is generated for your team to assign ownership, discuss as a team, assess indicators of compromise, and issue commands. It's more than a paper trail - it's a digital war room. # Education

General Overview A high-level overview of the LimaCharlie platform. It explains the architecture and various components of the platform at a high level. E-Learning Course		Quickstart The quickest way to get going. This course walks you through setting up your first DR rule, adding a threat feed, monitoring string distance and configuring email alerts. E-Learning Course Documentation
Basic Detection & Response An introduction to the principles of detection and response with an examination of basic DR rules. E-Learning Course YouTube Playlist		Advanced Detection & Response A brief review of basic DR followed by an examination of Artifact Events, False Positive Rules, Variables, Lookups and Stateful Rules. E-Learning Course YouTube Playlist
Setting up an MSSP This course outlines best practices for the most efficient use of LimaCharlie at scale. This structure is ideal for a Managed Security Service Provider (MSSP) or Security Operations Center (SOC) that is managing multiple organizations. E-Learning Course YouTube Playlist		Using the CLI & SDK With the CLI users can search across their entire fleet, search over historical data, replicate orgs, run spot checks on endpoints, push logs for ingestion. With the SDK users can capture data from the firehose or spout, and much much more. E-Learning Course YouTube Playlist
Monitor Windows Event Logs in Real-Time In this course you will learn about LimaCharlie’s powerful ability to capture and analyze Windows Event Logs (WEL) in real-time. Ingested WEL are indexed along common indicators of compromise (IoC’s) and run through the Detection & Response engine. E-Learning Course YouTube Playlist		Zeek Network Monitoring In this course LimaCharlie founder, Maxime Lamothe-Brassard walks through how users can leverage the agent to do PCAP capture on the network. Once the PCAPS are captured they can be re-ingested and processed by the Zeek Network Monitoring Tool. E-Learning Course YouTube Playlist
Ingesting Artifacts (Windows Event Logs, PCAPS, pfSense, Syslog & more) LimaCharlie can ingest almost any form of telemetry or logs and run detection rules against them. Windows Event Logs, PCAPS, pfSense, Syslog and many more with new formats being added constantly. Learn about ingesting and analyzing artifacts. E-Learning Course YouTube Playlist		Secure Access Service Edge (SASE) LimaCharlie Net is a Zero Trust solution that can create secure connections to internal resources based on the identity of the device regardless of the client location. Simple policies, mass provisioning, PCAP capture and analysis and much more! E-Learning Course YouTube Playlist