Limacharlie Expert

LimaCharlie Expert

Entry point skill for all LimaCharlie tasks. Provides component overview and routes to specialized skills.

Core Components

Telemetry Sources

Sensors (Endpoint Agents)

• Generate Events (NEW_PROCESS, DNS_REQUEST, NETWORK_CONNECTIONS, etc.)
• Execute sensor commands (history_dump, file_hash, os_processes, etc.)
• Receive D&R rule actions (isolate network, kill process, etc.)
• Have Tags applied to them

Adapters

• Ingest cloud/SaaS logs: AWS, Azure, GCP, M365, Okta, CrowdStrike, etc.
• Convert external telemetry into Events
• Feed same pipeline as Sensors

Installation Keys

• Enroll Sensors to organization
• Can auto-apply Tags

Detection Engine

D&R Rules

• Match against Events
• Generate Detections
• Execute Response Actions:
  • task - run sensor commands
  • run extension - trigger Extensions
  • add tag / remove tag - modify sensor Tags
  • isolate network / rejoin network
  • seal / unseal - tamper protection
  • report - create Detection
  • wait - delay for action chaining

Stateful Rules

• Correlate multiple Events over time
• Track counts, sequences, unique values
• Generate Detections with aggregated context

YARA Rules

• Real-time process scanning
• On-demand file/memory scanning
• Generate YARA_DETECTION Events → trigger D&R rules

False Positive Rules

• Suppress Detections
• Filter before Outputs

Managed Rulesets

• Pre-built D&R rules (Sigma, Soteria, SOC Prime)

Data Structures

Events (event stream)

• Structure: {routing: {...}, event: {...}}
• Generated by: Sensors, Adapters
• Matched by: D&R Rules
• Stored in: Insight
• Queried by: LCQL
• Forwarded by: Outputs

Detections (detect stream)

• Generated by: D&R Rules
• Includes: routing (from Event) + detect (Event data) + metadata (cat, priority, detect_data)
• Can trigger: D&R rules, Outputs

Audit (audit stream)

• Platform actions, config changes

Deployment (deployment stream)

• Sensor lifecycle events

Storage & Configuration

Insight

• 1-year retention of Events, Detections, Audit logs
• Queried by LCQL

Config Hive

• Stores: Secrets, Lookups (key-value), D&R rules, YARA rules
• Used by: D&R rules (lookup action), Extensions, Cloud Sensors
• Namespaces for organization

Tags

• Applied to: Sensors
• Used to: Target D&R rules, filter, group
• Modified by: D&R rules (add/remove tag actions), manual assignment, auto-enrollment

Query & Investigation

LCQL (LimaCharlie Query Language)

• Query: Events, Detections, Audit logs in Insight
• Returns: Filtered, aggregated, joined data

Timeline

• Per-Sensor Event history
• Complete forensic record

Sensor Commands

• 100+ investigative/response commands
• Triggered by: D&R rules (task action), manual execution, Extensions, API

Replay

• Test D&R rules against historical Events from Insight

Automation

Extensions

• Serverless functions
• Triggered by: D&R rules (run extension), API, schedules
• Can: Access Config Hive, call external APIs, read Events, respond with actions (add tag, run sensor command)
• Built-in: YARA Manager, Artifact Manager, VirusTotal, GreyNoise, etc.

Playbooks

• Visual workflow builder
• Orchestrates: D&R rules, Extensions, sensor commands

API & SDK

• Python/Go SDKs
• REST API for all platform operations

Data Forwarding

Outputs

• Destinations: SIEM, data lakes, Slack, webhooks, S3, etc.
• Source streams: event, detect, audit, deployment
• Can: Filter, transform data

Component Interconnections

Primary Data Flow

Sensors/Adapters → Events → D&R Rules → Detections → Outputs
                      ↓          ↓           ↓
                   Insight    Actions    Outputs

D&R Rule → Response Actions

D&R rules can trigger:

• Extensions → external enrichment/logic → respond with actions back to LC
• Sensor commands → investigate/contain on specific Sensor
• Tags → add/remove tags on Sensor → trigger other D&R rules targeting those tags
• Network isolation → quarantine Sensor
• Detections → generate alert → sent to Outputs
• Wait → chain multiple actions sequentially

Tag-Based Connections

D&R rule → Adds Tag to Sensor → Second D&R rule targets that Tag → Executes actions
Installation Key → Auto-applies Tag → Sensor enrolled with Tag → Targeted by D&R rules

Config Hive Integration

D&R rule → Lookup action → Config Hive (IOC lists, thresholds)
Extension → Reads secrets from Config Hive → Calls external API
Cloud Sensor → Stores credentials in Config Hive

Extension Integration

D&R rule → Run extension → Extension calls external API (VirusTotal) →
  Extension responds with: add tag, run sensor command, generate Event
Extension can: Read Config Hive, access Event data, trigger actions

Stateful Rule Correlation

Multiple Events (same/different Sensors) → Stateful rule (time window) →
  Counts/aggregates → Threshold met → Generate Detection

LCQL Query Flow

LCQL query → Insight (Events/Detections/Audit) → Results →
  Used for: hunting, investigation, rule creation

Multi-Component Chains

Example: Detection → Enrichment → Response

Event → D&R rule → Detection + Run extension (VirusTotal) →
  Extension adds tag "malware-confirmed" →
  Second D&R rule (targets "malware-confirmed" tag) →
  Isolate network + task: artifact_get

Example: Tag-based progressive response

Detection → Add tag "investigate" → Manual review → Add tag "incident-confirmed" →
  D&R rule on "incident-confirmed" → Automated containment actions

Field Paths & Targeting

Event field paths:

• event/FILE_PATH, event/COMMAND_LINE, event/DOMAIN_NAME
• routing/hostname, routing/sid, routing/event_type, routing/tags

Detection field paths:

• detect/* (original Event data)
• cat, priority, detect_data, routing/*

D&R rule targeting:

• Target by: routing/tags, routing/sid, platform, event type
• Filter by: any field path in Event

Component Output/Input Matrix

Specialized Skills

Route to these skills for detailed implementation:

Telemetry: sensor-manager, adapter-configurator, onboard-external-telemetry Detection: dr-rule-builder, stateful-rule-designer, sigma-rule-deployer, yara-manager Investigation: incident-responder, threat-hunter, lcql-query-builder, forensic-analyst, artifact-collector Automation: playbook-automator, extension-developer, api-integrator, threat-intel-integrator Management: config-hive-manager, infrastructure-as-code, output-configurator, cloud-security-monitor, performance-optimizer

Additional Documentation: If the specialized skills above don't provide enough information, the full LimaCharlie documentation is available in the public repository at https://github.com/refractionPOINT/documentation/tree/master/limacharlie

Key Mechanics

Response timing: D&R rules execute <100ms, sensor commands 1-5s Data retention: Insight stores 1 year by default Stateless vs Stateful isolation: segregate_network (command) vs isolate network (D&R action, persists reboot) Event types: 100+ event types (NEW_PROCESS, DNS_REQUEST, NETWORK_CONNECTIONS, WEL, YARA_DETECTION, etc.) Sensor platforms: Windows, Linux, macOS, Chrome Action chaining: Use wait action to sequence multiple responses in D&R rules

LimaCharlie is component-based: combine Sensors/Adapters (telemetry) + D&R rules (detection) + Extensions (enrichment/custom logic) + Sensor commands (response) + Outputs (integration) + LCQL (hunting) to build security solutions.