LimaCharlie provides information security tools and infrastructure designed for massive scale. The platform supplies all the tools to run an MSSP or SOC as well as providing API’s that allow users to build and monetize their own products.

Developer documentation can be found here.
Practical guides to getting things done can be found in the LimaCharlie Help Center here.
The REST API Documentation can be found here.

## Quickstart

To skip all of the details and get set up with endpoint detection and response capability you can follow our Getting Started guide or take the in-depth Quickstart e-learning course.

## Feedback & Feature Requests

If have feedback or would like to make a feature request please fill out the form here.

# Education

General Overview

A high-level overview of the LimaCharlie platform. It explains the architecture and various components of the platform at a high level.

E-Learning Course

Quickstart

The quickest way to get going. This course walks you through setting up your first DR rule, adding a threat feed, monitoring string distance and configuring email alerts.

E-Learning Course

Documentation

Basic Detection & Response

An introduction to the principles of detection and response with an examination of basic DR rules.

E-Learning Course

YouTube Playlist

Advanced Detection & Response

A brief review of basic DR followed by an examination of Artifact Events, False Positive Rules, Variables, Lookups and Stateful Rules.

E-Learning Course

YouTube Playlist

Setting up an MSSP

This course outlines best practices for the most efficient use of LimaCharlie at scale. This structure is ideal for a Managed Security Service Provider (MSSP) or Security Operations Center (SOC) that is managing multiple organizations.

E-Learning Course

YouTube Playlist

Using the CLI & SDK

With the CLI users can search across their entire fleet, search over historical data, replicate orgs, run spot checks on endpoints, push logs for ingestion. With the SDK users can capture data from the firehose or spout, and much much more.

E-Learning Course

YouTube Playlist

Monitor Windows Event Logs in Real-Time

In this course you will learn about LimaCharlie’s powerful ability to capture and analyze Windows Event Logs (WEL) in real-time. Ingested WEL are indexed along common indicators of compromise (IoC’s) and run through the Detection & Response engine.

E-Learning Course

YouTube Playlist

Zeek Network Monitoring

In this course LimaCharlie founder, Maxime Lamothe-Brassard walks through how users can leverage the agent to do PCAP capture on the network. Once the PCAPS are captured they can be re-ingested and processed by the Zeek Network Monitoring Tool.

E-Learning Course

YouTube Playlist

Ingesting Artifacts (Windows Event Logs, PCAPS, pfSense, Syslog & more)

LimaCharlie can ingest almost any form of telemetry or logs and run detection rules against them. Windows Event Logs, PCAPS, pfSense, Syslog and many more with new formats being added constantly. Learn about ingesting and analyzing artifacts.

E-Learning Course

YouTube Playlist

Secure Access Service Edge (SASE)

LimaCharlie Net is a Zero Trust solution that can create secure connections to internal resources based on the identity of the device regardless of the client location. Simple policies, mass provisioning, PCAP capture and analysis and much more!

E-Learning Course

YouTube Playlist

The Add-on Marketplace

LimaCharlie offers pre-configured capabilities and services that can be enabled at the click of a button through the Add-on Marketplace. Learn what types of capabilities and services are available and how you can make your own additions.

E-Learning Course

YouTube Playlist

˛