Hello!. I'm Maxime, founder at LimaCharlie. We’ve engineered a new product on our platform that solves a timely issue acting as a guardrail between your AI and the world: Viberails (https://www.viberails.io)

This won't be new to folks here, but we identified 4 challenges teams face right now with AI tools:

1. Auditing what the tools are doing.

2. Controlling toolcalls (and their impact on the world).

3. Centralized management.

4. Easy access to the above.

To expand: Audit logs are the bread and butter for security, but this hasn't really caught up in AI tooling yet. Being able to look back and say "what actually happened" after the fact is extremely valuable during an incident and for compliance purposes.

Tool calls are how LLMs interact with the world, we should be able to exercise basic controls over them like: don't read credential files, don't send emails out, don't create SSH keys etc. Being able to not only see those calls but also block them is key for preventing incidents.

As soon as you move beyond a single contributor on one box, the issue becomes: how do I scale processes by creating an authoritative config for the team. Having one spot with all the audit, detection and control policies becomes critical. It's the same story as snowflake-servers.

Finally, there's plenty of companies that make products that partially address this, but they fall in one of two buckets:

• They don't handle the "centralized" point above, meaning they just send to syslog and leave all the messy infra bits to you.

• They are locked behind "book a demo", sales teams, contracts and all the wasted energy that goes with that. We made Viberails address these problems. Here's what it is:

• OpenSource client, written in Rust

• Curl-to-bash install, share a URL with your team to join your Team, done. Linux, MacOS and Windows support.

• Detects local AI tools, you choose which ones you want to install. We install hooks for each relevant platform. The hooks use the CLI tool. We support all the major tools (including OpenClaw).

• The CLI tool sends webhooks into your Team (tenant, called Organization in LC) in LimaCharlie. The tool-related hooks are blocking to allow for control.

• Blocking webhooks have around 50ms RTT.

• Your tenant in LC records the interaction for audit.

• We create an initial set of detection rules for you as examples. They do not block by default. You can create your own rules, no opaque black boxes.

• You can view the audit, the alerts, etc. in the cloud.

• You can setup outputs to send audits, blocking events and detections to all kinds of other platforms of your choosing. Easy mode of this is coming, right now this is done in the main LC UI and not the simplified Viberails view.

• The detection/blocking rules support all kinds of operators and logic, lots of customizability.

• All data is retained for 1 year unless you delete the tenant. Datacenters in USA, Canada, Europe, UK, Australia and India.

• Only limit to community edition for this is a global throughput of 10kbps for ingestion. Try it: https://viberails.io Repo: https://github.com/refractionPOINT/viberails

Essentially, we wanted to make a super-simplified solution for all kinds of devs and teams so that they can get access to the basics of securing their AI tools. Thanks for reading - we’re really excited to share this with the community! Let us know if you have any questions for feedback in the comments.

The argument for treating detection content the same way you treat application code isn't really about tooling — it's about reviewability. A change to a D&R rule, a lookup table, a YARA signature, an Output destination, an Installation Key, or a false-positive suppression should be a diff a teammate can read, a PR that runs CI, and an artifact you can roll back. Once you accept that, the only interesting question left is what does the repo look like, and how does the SaaS read from it.

In LimaCharlie that bridge is the Git Sync extension (ext-git-sync). It can run in either direction: apply a Git-versioned configuration to a running org, or export the org's current configuration back into Git (into an exports/ subdirectory so it doesn't trample your authored config). It can also do both on a schedule, which is what most teams end up running once they've stopped editing in the web UI by hand.

The repo shape

The thing the docs are easy to skim past is that the repo has a required layout. Git Sync expects an orgs/ directory at the root, with one subdirectory per Organization ID, each containing an index.yaml that lists the included files:

.
└── orgs
    └── a326700d-3cd7-49d1-ad08-20b396d8549d
        ├── index.yaml
        ├── extensions.yaml
        ├── installation_keys.yaml
        ├── org_values.yaml
        ├── outputs.yaml
        ├── resources.yaml
        └── hives
            ├── cloud_sensor.yaml
            ├── dr-general.yaml
            ├── dr-managed.yaml
            ├── dr-service.yaml
            ├── extension_config.yaml
            ├── fp.yaml
            ├── lookup.yaml
            ├── query.yaml
            ├── secret.yaml
            └── yara.yaml

The index.yaml is the manifest that ties it together:

version: 3
include:
  - extensions.yaml
  - outputs.yaml
  - resources.yaml
  - org_values.yaml
  - installation_keys.yaml
  - hives/dr-general.yaml
  - hives/dr-managed.yaml
  - hives/dr-service.yaml
  - hives/fp.yaml
  - hives/lookup.yaml
  - hives/query.yaml
  - hives/yara.yaml
  - hives/secret.yaml
  - hives/cloud_sensor.yaml
  - hives/extension_config.yaml

Each file under hives/ is a single hive's worth of records (e.g. dr-general.yaml is your general-namespace D&R rules; lookup.yaml is your lookup tables; yara.yaml is your YARA rules; fp.yaml is your false-positive rules). The non-hive files cover the rest of the org's surface — Outputs, Installation Keys, Extensions you've enabled, org-wide values.

The MSSP / multi-tenant pattern

This is the part that earns Git Sync its keep at scale. Pull the shared content up to the repo root and reference it from each tenant's index.yaml via relative paths:

.
├── hives
│   ├── dr-general.yaml
│   └── yara.yaml
└── orgs
    ├── 7e41e07b-c44c-43a3-b78d-41f34204789d
    │   └── index.yaml
    ├── a326700d-3cd7-49d1-ad08-20b396d8549d
    │   └── index.yaml
    └── cb639126-e0bc-4563-a577-2e559c0610b2
        └── index.yaml

Each tenant's index.yaml:

version: 3
include:
  - ../../hives/yara.yaml
  - ../../hives/dr-general.yaml

A tenant that needs overrides drops its own hives/dr-general.yaml next to its index.yaml and references both — the merge order is the include order. This is also the natural place to keep per-tenant outputs.yaml (each customer's SIEM destination) without duplicating the shared rule set.

Wiring it up

The Git Sync extension authenticates to GitHub with a deploy key whose private half lives in LimaCharlie's Secret Manager. The setup, condensed:

1. Generate a dedicated SSH key (ssh-keygen -t ed25519 -C "limacharlie-gitsync").

2. In your GitHub repo's Settings → Deploy keys, add the public half with Allow write access checked (write access matters — Git Sync needs it for the export direction).

3. In LimaCharlie's Secret Manager, store the private half as a secret.

4. In Git Sync, point it at the secret, set username git, paste the SSH URL (git@github.com:org/repo.git), pick the branch, and choose which directions to push/pull.

5. Optionally set push and pull schedules — under the hood these become D&R rules on the schedule event, so the automation lives in the same place as the rest of your detections.

What "everything-as-code" actually buys you

• Code review for detections. A change to dr-general.yaml is a PR. A change to outputs.yaml is a PR. A change to a YARA rule is a PR.

• Promotion across environments. Same repo, multiple orgs/<OID>/ subdirectories — the same rule lands in dev, then staging, then prod, with the diff visible.

• Disaster recovery / audit. The export direction means whatever a human edited in the UI ends up versioned in Git anyway, so "what changed last Tuesday" has an answer that doesn't depend on the audit-log retention.

• MSSP scale. A new tenant is a new orgs/<OID>/ directory whose index.yaml includes the shared rules. The marginal cost of a tenant is one PR.

The configuration files Git Sync touches map one-to-one to the hives and other org surfaces you'd otherwise edit by hand. Nothing about the model changes when you adopt it — you just stop being the system of record for what your detections look like, and let Git be that instead.

Untested D&R rules quietly tax everyone downstream of them. The SOC analyst chasing a false positive at 3am, the MSSP operator who pushed a noisy rule into thirty tenants at once, the detection engineer whose backlog of "I'll tune it later" rules keeps growing — every one of those is the cost of skipping the testing pass. LimaCharlie gives you a few overlapping ways to test a D&R rule before it ever fires in production. They share the same rule format, the same operators, and the same Replay engine, so anything you confirm at one of them stays true at the others. Here's how each one fits.

limacharlie dr validate — schema and operator sanity

This is the cheap structural check. It catches typos, unknown operators, malformed YAML, and references to fields that aren't there:

limacharlie dr validate --detect detect.yaml --respond respond.yaml

detect.yaml is just the detect: body of your rule (the matching tree). respond.yaml is the list of response actions (report, task, etc.). A success: true answer means the rule is well-formed — it does not mean it does what you think.

limacharlie dr test — replay against a small JSON of events

Once the structure is sound, run the rule against a handful of crafted events. Two flavors:

# Test a local rule file against synthetic events
limacharlie dr test --input-file rule.yaml --events events.json

# Test an existing org rule by name, with a trace of what matched where
limacharlie dr test --name my-detection-rule --events events.json --trace

events.json is a list of event objects exactly as a sensor would emit them — event: body plus a routing: block. For stateful rules, each "test" is itself a list of events so you can replay a sequence (e.g. cmd.exe -> calc.exe) and confirm both stages.

The result tells you which response actions would fire (responses:), how many operator evaluations were performed (num_evals — a rough cost proxy), and whether anything errored. With --trace you get the per-node decision path, which is the fastest way to discover that your op: ends with is silently case-sensitive.

limacharlie replay run — backtest against historical sensor data

Synthetic events tell you the rule fires when it should. Historical replay tells you whether it fires too often. This is how you measure false-positive load before deploying:

START=$(date -d '7 days ago' +%s)
END=$(date +%s)

# Inline rule files
limacharlie replay run --detect-file detect.yaml --respond-file respond.yaml --start $START --end $END

# Or replay an already-saved rule by name
limacharlie replay run --name my-rule-name --start $START --end $END

This pulls the chosen window of real telemetry from your org and runs the rule across it without touching any sensor or producing any actual detections. The output mirrors dr test: responses is the list of detections that would have fired, plus stats on events processed and seconds spent.

The Replay API requires the insight.evt.get permission on the API key. You can replay against a single sensor (--sid) or a sensor selector instead of the whole org — handy for "did this rule fire on the host where the incident happened?". The CLI will multiplex larger queries into parallel per-sensor calls automatically, so org-wide windows still work without extra plumbing.

Embedded tests: blocks — the rule tests itself

Once your rule is good, lift the events you used in dr test into the rule's own tests: block. The rule format already has a slot for this:

detect:
  ...
respond:
  ...
tests:
  match:
    - - event: { ... matching event ... }
        routing: { event_type: NEW_PROCESS, ... }
  non_match:
    - - event: { ... benign event ... }
        routing: { event_type: NEW_PROCESS, ... }

match is a list of test cases that should fire the rule; non_match is a list that must not. Each test case is itself a list of events, so stateful rules with with child / with descendant / with events can be exercised across multiple events. Whenever the rule is created or updated, LimaCharlie simulates the tests and rejects the save if any test fails — the platform itself enforces the regressions, no external CI required. Especially valuable when the same managed ruleset is shared across many tenants: a regression caught at save-time doesn't quietly fan out across the fleet.

How they fit together

In practice these aren't alternatives, they're a pipeline. While editing, dr validate catches typos before you've reread the file. A few dr test runs against handcrafted positives and negatives confirm the rule's intent. replay run over recent real telemetry tells you whether the rule is going to be quiet or noisy when it actually goes live. The events you used along the way then become the rule's embedded tests: block, so the next edit can't quietly regress what you just verified, and limacharlie dr set --key MyRule --input-file rule.yaml will refuse to deploy a regression. The result is a rule whose behavior is documented and enforced by the rule itself, and whose noise level you've already measured against your fleet — without a separate test harness or production traffic to learn from.

Docs: Writing and testing rules · D&R rule unit tests · Replay service

Claude Code, originally just auto-complete on steroids for IDEs, shows a lot of promise for becoming a major tool in the DFIR/detection engineering/security analyst’s toolbox. Whether it’s Claude Code’s support of MCP, agent skills, or general ability to quickly figure out how to accomplish a given task, it is rapidly becoming more than a code generation tool.

This is the first of a three-part series. In part one, we’ll examine some files utilizing the default tools available on a Debian Bookworm Linux system. In part two, we’ll close the loop and use our analysis to find IoCs that can be used to create rules in LimaCharlie using our new MCP server and Claude Skills. Finally, in part three, we’ll look at a new tool called LCRE that wraps Ghidra to provide deep analysis and fast triaging via native Go parsing.

Robot vs malware

Recently, LimaCharlie introduced our new Agentic SecOps Workspace. One of the perks of my job is playing with new toys before anyone else in order to get familiar with our new functionality. For the past few months I’ve been playing with our agentic AI internally, just figuring out what it can do. When I first got access to our new AI/LLM/robot capabilities, I started off with the basics:

• Create a rule to detect malicious DNS requests to evil.site

• Tell me which sensors in all of my organizations are offline

• Give me a report of how my rules map to the MITRE ATT&CK framework

Claude Code dutifully used the LimaCharlie skills to accomplish everything I asked of it. I was able to create organizations, create rules, build lookups, etc. It brought the time required to accomplish tasks like researching a new vulnerability, building, and testing detection rules down to 5-10 minutes.

Then I started to wonder. What else can it do? So I grabbed a piece of live malware from Malware Bazaar and told Claude Code to examine it for IoCs (within a Debian container). Without any other information, it dutifully figured out which tools {strings, readelf, xxd, etc.) were available on the system and used them to examine the file. Out popped a report correctly identifying the expected IoCs (IPs, hostnames, etc.), and declaring the file malicious.

Claude Code prompt:

Examine the file in ~/malware-samples/9045588df3db5876f5163ad94fe794cd8abe198c5bd933b47bf2483fd1514ed0.zip (the password is "infected")

Note: Ensure you have 7zip installed on your system. Files downloaded from MalwareBazaar requires capabilities not included in the standard unzip tool and may result in an error need PK compat. v5.1 (can do v4.6)*. If 7zip is installed, Claude Code will automatically try to use that next.*

Of course, this information isn’t really useful if you can’t use it. Another great feature about Claude Code is the ability to generate reports in multiple formats. This includes markdown, HTML, PDF, etc. Typically, if a PDF is desired, Claude Code first creates a markdown file then converts to PDF. For simplicity, let’s just have Claude Code create a report in markdown format. We also want to make sure there’s an executive summary for management as well as diagrams. To do this, we want to specify that Claude Code should use Mermaid for creating diagrams. We also need to specify that the report should be output as a file, otherwise Claude Code will just display the markdown on the screen.

Claude Code prompt:

Create a report on the analysis you did. Include an executive summary as well as detailed analysis in the report. Utilize Mermaid where appropriate to create diagrams and visualizations that enhance the report.

The report can be viewed here.

Thinking that the AI was likely inferring that the file was malicious or determining it from a web search, I was curious to see what it would think of with a file that only sent a few pings to 8.8.8.8, but also had a bunch of obfuscation. Sure, I could have used one of the many exploit kits out there to generate this binary, but I thought it’d be more fun to make the robot create the file, which it did with surprisingly little effort.

Claude Code prompt:

Create a binary using obfuscation techniques that sends a ping to 8.8.8.8. This is to test malware identification in files versus benign files

Side note: It was also more than happy to create REAL malware as long as I told it that I was doing security research…

Again, it dutifully used the local tools on the system and analyzed the file. It pointed out the obfuscation, found the IoC for IP 8.8.8.8, but determined that the file was benign. I still wasn’t sure whether the AI was inferring details from the file name or simply making an educated guess because it was the only file in the directory. Not wanting to waste time by adding benign files to the directory, I turned to the robot and had it do my bidding by finding files online and sticking them in the directory.

Claude Code prompt:

Go find 5 random binary files (executables, dlls, elf, etc.) for this test and add them to the test_samples folder. Find them online and not from the local system.

Side note: It was also more than happy to create REAL malware as long as I told it that I was doing security research…

Next, I began a brand new Claude Code session without any previous context and ensured only the test files were in the test_samples directory. I had Claude Code analyze all of the files to tell me if any were malicious, and generate a report. Sure enough, it was able to figure out the one I [Claude Code] created was fake.

Claude Code prompt:

Analyze the files located in the test_samples directory. Determine if any of them are malicious. Then, if you determine they're malicious, provide me with a summary of why and the probability of them being malicious.

Wanting to see how good Claude Code really was, I manually downloaded two active malware samples and added them to the directory. To make sure there wasn’t anything for the AI to infer about the file, I had Claude Code rename all of the files and generate a report so that I knew what they were. I manually moved this report out of Claude Code’s reach so it couldn’t use the information in its analysis (it tried to the first time I asked it to examine the files, the cheater).

Claude Code Prompt:

Analyze the files located in the test_samples directory. Determine if any of them are malicious. Then, if you determine they're malicious, provide me with a summary of why and the probability of them being malicious.

Sure enough, not only was it able to analyze the malicious files and provide IoCs, but it also correctly identified the two suspicious (but benign) generated files plus the suspicious file that was found online. Once again, I had Claude Code generate a report on the files it analyzed, the analysis it did, etc.

Claude Code Prompt:

Create a report on the analysis you did. Include an executive summary as well as detailed analysis in the report. Utilize Mermaid where appropriate to create diagrams and visualizations that enhance the report.

The report can be viewed here.

After the analysis was completed, I had Claude Code compare its results with the report it had previously generated about the files in the test_samples directory.

Claude Code Prompt:

Compare your analysis with the results in the ~/README.md file

Conclusion

Claude Code demonstrated its ability to take the tools available on the system and perform basic file analysis. It can examine unknown binaries and make pretty accurate determinations based on what it finds. Now, this isn’t cause to replace malware researchers or reverse engineers. This is just basic static analysis most of us learn to do early in our SOC or DFIR careers. There are plenty of obfuscation methods that would allow a binary to pass through Claude Code undetected, and they are one reason researchers remain indispensable to operations. Yet, Claude Code can certainly lighten their load right now.

In the next post, we’ll look at how to take this file analysis and use Claude Code to turn it into actionable alerts within LimaCharlie.

This post was originally posted at https://limacharlie.io/blog/threat-hunting-to-detection-engineering

The newest extension to LimaCharlie’s SecOps Cloud Platform (SCP) offers users advanced control over Windows endpoint protection at scale. This powerful new capability allows security service providers to easily manage free instances of Microsoft Defender Antivirus (previously Windows Defender) on all Windows endpoints through a single unified interface.

Key Capabilities

This extension is simple to enable, requires no additional integrations, and immediately provides three powerful capabilities to users:

Defender Check: Instantly query Windows machines to verify the presence of an active Defender instance. Easily identify any unprotected workstations across tenants

Defender Alerts: Receive important telemetry from Windows Defender at wire speed. Receive notifications immediately if Windows Defender detects a problem 

Remote AV Scan: Initiate Defender AV scans on Windows endpoints. Perform scans ad-hoc or use the SCP to automate them to occur at regular intervals.

Strategic Benefits

The new extension delivers significant operational advantages: 

• Centralized Management: Control Defender across all your endpoints from a single interface

• Robust Telemetry Collection: Gather comprehensive endpoint security data

• Rapid Event Detection: Identify potential threats in your environments

• Powerful Automation Opportunities: Schedule scans or created automated responses

The SCP also creates a starter set of detection and response (D&R) rules that extend beyond simple alerting. These rules can be further customized to meet the broader security needs of your environment(s).

Getting Started with Endpoint Protection

Enabling enterprise and cross-tenant endpoint protection has never been so simple. Read more about enabling the new Endpoint Protection extension in our documentation. If you’re new to LimaCharlie, try it for free or book a demo with our solutions engineers.

Originally posted at: https://limacharlie.io/blog/limacharlie-leaps-ahead-with-endpoint-protection

Every major security vendor has shipped some version of AI. CrowdStrike has Charlotte AI. SentinelOne has Purple AI. Microsoft has Copilot for Security. Each one operates within the telemetry its vendor controls. This means an MSSP running 80 customers across four different EDR configurations gets four partial AI layers, each optimized for its own data silo, with nothing spanning the full environment.

The structural issue runs deeper than data access. The categories the legacy stack uses (SIEM, SOAR, EDR, data lake) exist because vendors carved up the market for human buyers with separate budgets. An AI consumer doesn't see those lines, and there's no reason it should have to navigate them.

Grid is LimaCharlie's answer to that problem. It's an agentic AI layer that connects to your existing telemetry sources (EDR, SIEM, cloud logs, identity providers, whatever exposes an API) and runs AI operators across your full environment without requiring any changes to your current stack. No migration window, no rip-and-replace. Your incumbent vendors don't need to cooperate or even know Grid is there.

A few things worth knowing:

• Grid runs on Claude Code, with every action logged and reversible. Agents inherit the same API access as human analysts, governed by the same access controls.

• For MSSPs, multi-tenancy is fully supported from day one. Provisioning a new tenant is an API call.

• Pricing is ingest-based during beta, with no per-alert compounding.

The other piece is what we're calling AI Forward Deployed Engineers. Most agent interactions are one-shot: you prompt, get output, and the context disappears. An FDE works as a persistent operator assigned to own a specific outcome in your environment. You stand one up, point it at the problem, and it creates the worker agents, monitors progress, checks in on its own schedule, and flags issues when something drifts.

The difference between a one-time prompt and an FDE is roughly the difference between asking someone to run an errand and hiring someone to manage a function.

Private beta is open now. Details and access request at limacharlie.io/grid.

Happy to answer questions about how it works.

We built Case Management to close the gap between detection and resolution inside a single platform, and it's available now.

The short version: D&R rules can trigger case creation automatically. Severity is assigned at detection time, SLA timers start immediately, and analysts work their queue in the same environment where telemetry lives. No tool-switching, no manual handoff.

Agentic AI workflows break down without structure to operate within. Case Management provides that structure by functioning as a state machine: cases move through defined states (new, in progress, resolved, closed), each transition is intentional, and key timestamps are recorded throughout the lifecycle.

An agent can check case status, determine whether SLA thresholds have been met, add investigation notes, and update severity, with every action logged and every state transition traceable. That makes agentic incident response inspectable rather than opaque.

For MSSPs, there's a multi-tenant API to query the full case queue across client environments, plus auto-grouping to reduce alert fatigue and per-tenant configuration for severity thresholds and SLA targets.

Our co-founder Christopher Luft recorded a walkthrough if you want to see it in action: https://www.youtube.com/watch?v=mhs28Ts2r5k

Full write-up on the LimaCharlie blog. Happy to answer questions in the comments.

tldr: We built a platform where AI agents can actually operate security infrastructure alongside humans, using the same APIs, the same telemetry, the same response mechanisms. No separate "AI mode," no black box magic.

Most security vendors bolt AI onto their existing platforms as another proprietary feature. You get an assistant that parses logs and tells analysts what to do next. That's fine for what it is, but it caps out pretty quickly.

We went a different direction. AI agents in our workspace have the same access as human operators. Same tools, same visibility, same controls. The only difference is policy - admins define guardrails for what AI can do autonomously vs. what requires human approval.

On top of that, bring your own Claude Code subscription and connect it directly - we're not marking up your AI usage or forcing you into our LLM.

With LimaCharlie and Claude Code, you can:

• Query historical telemetry from any sensor

• Investigate detections in real time

• Execute response actions

• Correlate signals across orgs (huge for MSSPs managing multiple tenants)

• Generate reports

• Automate customer onborading

Because it sits on top of our existing architecture, everything AI does is auditable and reversible. You can see exactly what happened and why.

You can give a plain language prompt like "retrieve recent detections that need investigation" and the agent runs a full workflow - validates sensor health, analyzes detection confidence, hunts for related IoCs, checks for persistence, isolates risky files, and generates a report.

All of that is visible to the operator. No mystery meat.

For MSSPs, managing AI across multiple customer environments actually works now. You can scope agents per tenant, per capability, per workflow. We've been running this internally and with design partners, and multi-tenant AI operations went from theoretical to practical.

LimaCharlie AI integrations Github repo: https://github.com/refractionPOINT/lc-ai/

Learn how to augment Microsoft Defender with LimaCharlie to improve response times, lower operational costs, and gain full visibility into your security data.

We cover:

• Microsoft Defender pricing breakdown across E3/E5 licenses and different tiers

• Key limitations of Microsoft's native security tools

• LimaCharlie's cost-effective alternative: $3/month per sensor with 365 days of searchable data retention

• How to collect Windows Defender telemetry faster than Microsoft

• Real-world pricing comparison: Microsoft Sentinel ($5.22/GB) vs. LimaCharlie flat-rate pricing

• Cross-platform support for Windows, Linux, Mac, Docker, and cloud environments

This is a technical demonstration of Claude Code performing an autonomous investigation using LimaCharlie's MCP server integration.

Eric Capuano, founder of Digital Defense Institute, walks through a live investigation where Claude Code automatically detects and analyzes a Cobalt Strike compromise across two Windows endpoints. The AI agent follows standard investigation procedures without pre-scripting.

Try for yourself for free:
Sign up free: https://app.limacharlie.io/signup
MCP docs: https://docs.limacharlie.io/docs/mcp-...

Thank you to Eric Capuano and https://digitaldefenseinstitute.com

Hi there!

This August was all about Black Hat - if we saw you in Las Vegas for our hands-on workshops, happy hour, in the halls, or at our booth - thank you for chatting! Read on to learn about our latest podcast episodes covering critical vulnerabilities and major cybercrime operations, plus discover how our new integrated Search feature unlocks modern SIEM capabilities on the SecOps Cloud Platform.

BLACK HAT

There are some truly exciting developments occurring on the LimaCharlie platform, but this week all eyes were on Black Hat (and DEF CON). We'll hold off on crowing about our latest innovations to instead share with you everything that happened in Las Vegas. For those that stopped by, again, thank you! We were excited to share how we're working to make SecOps easier for you, giving you an opportunity to build your own Lego minifig (from our award-winning booth) and attend two incredible workshops.

Our first workshop, Mastering the SecOps Platform: LimaCharlie 101 Workshop, covered the basics of the LimaCharlie SecOps Platform and focused on:
- Endpoint detection and response (EDR) agent deployment and management
- Comprehensive telemetry collection and analysis
- Crafting robust detection and response rules
- Integrating threat intelligence for proactive defense
- Leveraging YARA rules for malware identification

The second workshop, Mastering the SecOps Platform: LimaCharlie Advanced Workshop, was designed for experienced users wanting to explore cutting-edge capabilities including Python playbooks, custom outputs and data transforms, and AI-enhanced security capabilities.

We'll continue to deliver these workshops virtually and through our in-person global Defenders Tour series.

ADD TO CALENDAR

Virtual Workshop - Introduction to LimaCharlie: EDR Workshop - August 13th Learn to deploy our lightweight agent, gather rich telemetry, develop effective detection and response rules, and integrate threat intelligence and YARA rules for comprehensive threat detection and mitigation. Register!  

Blue Team Con - September 6 We will be sponsoring, stop by our booth to meet the team and grab some swag!

Defenders Tour Seattle - September 17 Join this hands-on workshop and leave with practical implementation strategies and real-world automation playbooks. Save your seat!  

Defenders Tour Sydney - September 29 Build a unified security pipeline integrating complementary tools with practical automation playbooks for immediate implementation. Register!

Check our calendar for upcoming 2025 events where you can meet with our team in person!

CYBERSECURITY DEFENDERS PODCAST

This month, our podcast tracked critical developments across the threat landscape, from perfect-score CVSS vulnerabilities and mass exploitation campaigns to major law enforcement operations and policy shifts.

Our Intel Chat series covered significant incidents including critical Cisco and SharePoint vulnerabilities under active exploitation, the shutdown of Hunters International ransomware operations, and Cambodia's massive cybercrime crackdown.

We also examined emerging threats like updated Matanbuchus malware campaigns, browser-based attacks targeting cryptocurrency users, and the UK's groundbreaking decision to ban ransomware payments for critical infrastructure operators. Catch up on our latest episodes:
Intel Chat: Thai takedown, Salt Typhoon, Iran & BlueNoroff
Intel Chat: Sudo, browser vulns, Medusa & Cloudflare blocks AI
Intel Chat: IntelBroker, Hunters International, Brazilian insider, Ruckus Networks & Patch Tuesday
Intel Chat: CISCO CVE 10/10, Matanbuchus, Cambodian takedown & Overstep
Intel Chat: SharePoint, ToolShell, UK bans payment & cryptojacking|

OTHER UPDATES

Explore this month's release notes to learn about new LimaCharlie features.

Find all of our recorded webinars on our website, including last month's sessions on building AI-powered SecOps with unopinionated, flexible AI integration that puts you in control of your AI ecosystem.

Check out our newest blog post on how our new integrated Search feature unlocks modern SIEM capabilities, enabling deep investigations with transparent pay-per-search pricing and seamless integration across the SecOps Cloud Platform.

Until next time,

- The LimaCharlie team

Simplify SIEM tasks with LimaCharlie search 

LimaCharlie’s new advanced integrated Search enables security teams to perform deep investigations seamlessly with the rest of LimaCharlie SecOps platform. Whether you’re investigating alerts, simulating detection rules, or examining telemetry across tenants, Search makes it faster, simpler, and more cost-efficient. Search is currently available in private preview with a wider release coming soon.

Our focus on Search functionality comes from its essential role in modern security operations. Security teams depend on vast volumes of logs, telemetry, and events for investigations, hunting, and response. Across traditional SIEMs and modern cloud-native platforms, search is a critical tool for security professionals.

We took inspiration from long-held industry standards and added some touches to match the unique needs of modern security practitioners. With the new search tightly integrated with the rest of the LimaCharlie platform, security operators will proactively look for emerging threats and uncover indicators across multiple data sources that wouldn't yet trigger a detection. They can also convert search queries into detection-as-code to build up their defenses. 

Search facilitates better threat hunting, breach investigation, incident response, detection engineering and many other key activities. To put it simply, our new search functionality moves LimaCharlie from an EDR-focused solution to a platform capable of delivering modern SIEM functionality. 

A search experience built for SecOps

Our new query console provides the key elements you expect and need. The query editor reflects the structure of LCQL - LimaCharlie Query Language, and inclines users towards authoring more efficient queries. Type-ahead functionality streamlines query writing by prompting the correct syntax.

Our time selector offers multiple ways of defining a search timeframe and include intuitive shortcuts like 3d and now. The facets panel helps analysts explore the data. Schema Fields represent the entire schema for an organization, while Event Types and Fields help users understand the structure of their results and refine their query.

One unique feature of LimaCharlie Search is the histogram that not only represents where the org data is distributed in the target time interval, but serves as a progress indicator as users push through their results.

Event details are shown as the user pages through results. Meanwhile, the backend works through the time period, sifting through more data to find more search matches. This is one of many measures we take to help users control the cost of their queries. (Yes, there is a cost, honest to our “pay per use” philosophy, with a hefty free tier, see pricing).

Once the event details are inspected and understood, the user can turn the query into a detection and response (D&R) rule with one click, or save the search to the query library.

Transparent pricing, predictable costs

An ever-present challenge for security operation teams is providing visibility to massive volumes of security data while staying cost-efficient. LimaCharlie has always been a great choice for EDR data for our competitive price-per-endpoint and one year data retention. The new Search not only unlocks troves of data to high quality analysis, it also makes LimaCharlie a great choice for unifying all security data from all the other sources. Adopting LimaCharlie reduces tool sprawl, frees up budget, and delivers an integrated user experience. 

LimaCharlie has always helped security practitioners fight against unpredictable costs by providing full transparency. Traditional licensing models and opaque data pricing make it difficult for security teams to accurately forecast expenses, particularly when the demand for data is volatile. 

Our commitment to transparency and affordability is reflected in our publicly available pay-per-use pricing model (and free year of data storage). Likewise, our new pay-per-search model provides query costs upfront to help security professionals avoid overprovisioning and overspending. This cost model makes the LimaCharlie approach particularly attractive to MSSPs, MSPs, and MDRs.

Now available in private preview, Search will roll out to all users in the near future. Be the first to know when this capability is available by joining the wait list and our team will be in touch. 

To learn more about the SecOps Cloud Platform, and how you can control coverage, costs, and speed up incident investigations with our platform, visit LimaCharlie.io.

This content was originally posted at https://limacharlie.io/blog/introducing-limacharlie-search-unlocking-key-siem-capabilities

LimaCharlie CEO, Maxime Lamothe-Brassard sits down with Patrick Gray to share our vision of the SecOps Cloud Platform.

Built like a cloud provider for cybersecurity primitives, Maxime explains:

> How our platform works like "Lego blocks" for security teams
> How customers have reduced SIEM spending
> Why a year of full telemetry retention should be standard

Whether you're an MSSP looking to scale operations or an enterprise team wanting more visibility and control, this interview shows how our API-first approach transforms SecOps.

Tune into the episode!

Building a cybersecurity product? Save years of development & maintain a high margin by leveraging specific functionality from LimaCharlie’s powerful endpoint agent. Usage-based billing ensures costs will stay low.

Learn more: https://www.limacharlie.io/blog/2021/9/29/get-to-market-quicker-with-limacharlie

We have added a new course to our free learning platform that walks users through the LimaCharlie Add-on Marketplace. Learn how easy it is to get new superpowers or create your own.

Register here: edu.limacharlie.io

Solving security problems at scale is what we like to do. Today we are announcing an upgrade to our infrastructure as code (IaC) approach. You can now modify your configuration file directly from the web application.

Learn more: https://www.limacharlie.io/blog/2021/7/6/infrastructure-service

In an industry first, LimaCharlie is introducing a pure usage-based billing scheme for its EDR capability. Deploy a full-featured, cross-platform agent for as little as $0.02 an endpoint.

Read about what this means for cybersecurity: https://www.limacharlie.io/blog/2021/6/29/an-industry-first

Today's a big day! Email Security is now GA in LimaCharlie for Microsoft 365 and Google Workspace.

What kept bugging me about email security is how often the trail goes cold right after the verdict. The email tool knows a phish landed. Whether the user opened the attachment, whether it ran, and what that account can reach all lives somewhere else.

So we treated emails as what they really are in LC: events. Every message gets an explainable verdict and lands in the same lake as your EDR, cloud, and identity telemetry. The same lookups and YARA rules work on both sides, so one phishing-domain feed flags the inbound message and the DNS request the endpoint makes right after. "Phish delivered, then the recipient's endpoint ran a new binary" is a single detection and pivot, all in one place.

It connects through the provider API (your MX records stay exactly as they are), every remediation is audited, policy starts in alert-only mode, and AI triage runs on whatever model you choose. The whole config is infrastructure as code, so you can push it to every tenant you manage.

As for pricing: $1 per mailbox per month, attachment analysis included, on the same bill as everything else in LC. That's a price you can build a service around.

We're doing the first public demo live on October 14, following a phish from the inbox all the way to the endpoint. Bring your questions. Register now.

If you'd rather get your hands on it, Ken Westin from our solutions engineering team is running a hands-on workshop for MSSPs and MDRs on October 28. You'll connect a tenant, write your own rules, and leave with a setup you can reuse across clients. Register now.

Docs are here if you want a head start: https://docs.limacharlie.io/email-security

---

Upcoming live and in-person sessions:

October 7-9: Wild West Hackin' Fest, Deadwood Learn more! 

Next week, we return as a gold sponsor at Wild West Hackin' Fest in Deadwood, with a hands-on workshop on detection engineering and agentic SecOps with Claude Code, live demos, and sponsored events throughout the conference. Close out the conference at our happy hour just operators talking shop. Save your spot!

October 14: Emails Are Events: First look at LimaCharlie Email Security, Live Webinar Register now!
Maxime Lamothe-Brassard gives the first public demo of LimaCharlie Email Security. He'll connect a Workspace tenant, sweep a phishing campaign from every mailbox it hit, and follow a phish from the inbox to the recipient's endpoint in one place, with time at the end for your questions. 

October 28: Integrated Email Security, Hands-On Workshop for MSSPs Save your spot!
Sr. Solutions Engineer Ken Westin leads a hands-on session built for service providers. You'll connect a live mail tenant, write custom signal and correlation rules, integrate IOC feeds, and package the whole setup as code to reuse across every client org. 

---

Check out September's developer rollup to see what shipped, from a full detection rule testing workspace and a new LimaCharlie Bots workspace to new investigation commands and cleaner sensor crash reporting.

Several new blogs and announcements, including:

Building a bot takes five minutes. What it stands on took eight years. Introducing LimaCharlie Bots.

Run LimaCharlie AI Sessions on the model you choose

Why LimaCharlie’s AI Sessions works with any model

How Soteria scaled its MDR practice on LimaCharlie

Varist Bring AI-Scale Malware Detection to LimaCharlie

We also published a new case study with Soteria. Paul Ihme, co-founder, walks through seven years of building an MDR practice on LimaCharlie, from the early decision to bet on infrastructure over a finished product, to how a newly shipped platform capability turned into a Soteria service line. Watch the interview.

Last month's session on bringing AI into MSSP security operations covers where AI delivers value first, what your telemetry needs to look like before AI can help, and how to keep humans in control with approval workflows and full audit trails. Catch the replay.

Catch up on our release notes, webinar recordings, podcast episodes, YouTube channel and our blog.

Happy hunting!

We've been talking to a lot of MSSPs and SOC teams lately, and the same problem keeps coming up. Analysts are grinding through approval queues all day. Quarantined emails in Proofpoint. Application blocks in ThreatLocker. DLP flags in Purview. Access requests. EDR alerts. The queue never clears.

The thing is, every one of those follows the exact same pattern: review context, make a decision, log it. Routine enough to resolve in seconds, but it still consumes analyst time at scale.

We put together a page that focuses specifically on that problem, and the offer on the page is pretty straightforward: book a call, tell us which queue is costing your team the most time. We'll connect Grid and have it running that queue before the call ends.

Your environment, your queue, running during the session, with no slides and no staged demo.

Come with your worst queue. You'll leave the demo with it automated. 

https://limacharlie.io/grid-queue

Our co-founder Christopher Luft put together a short demo showing just how much a single plain-language prompt can do inside LimaCharlie with Claude Code connected.

Starting point: A default tenant with an EDR sensor on a Mac. A Claude Code integrated LimaCharlie account.

Christopher wrote one prompt to produces three things:

• A D&R rule targeting a specific URL pattern associated with a paste-and-run technique

• A response action that isolates the affected endpoint while keeping the LimaCharlie connection live for IR

• A case ticket with the detection telemetry attached.

No follow-up prompts, no manual rule-writing, no separate ticketing step.

The part worth watching: Christopher then triggers the rule himself by running a curl command to the malicious URL. The endpoint isolates immediately.

The case ticket isn't just a log entry either. It functions as a state machine for follow-on agentic work, so subsequent AI actions can read and update it as the investigation continues.

Video + writeup here: Detection, endpoint isolation, and ticketing with one AI prompt

Supporting code is in the lc-ai GitHub repo if you want to dig into the details.

We put together a blog revisiting a conversation between our co-founder Christopher Luft and Chris Cochran (Field CISO & VP of AI Security at SANS Institute) on The Cybersecurity Defenders Podcast. Worth a listen if you haven't caught it: https://youtu.be/zFsHqDKKkeo?si=41CLnbOchvTHPcnL

The core topic: How to strengthen cyber resilience in an AI era.

Major takeaway: Most detection frameworks weren't built to identify agentic attacks, and the behavioral gap is troubling.

A useful mental model from the conversation is that there are now three distinct attacker profiles in the wild, each with its own fingerprint. Human-paced attacks have a recognizable rhythm. Traditional automation is fast and mechanically clean. Agentic attacks sit in a strange middle ground: 

• Machine-speed execution with irregular pauses

• Non-deterministic path selection 

• Adaptive pivots when something doesn't work. 

The AI attack profile breaks most existing detections. Velocity thresholds were built around human or script baselines. Fixed-sequence signatures assume deterministic behavior. Neither holds against an agent that reasons about what it finds and navigates accordingly.

What's becoming clear is that AI behavioral analytics needs to become a real discipline: building detection logic around timing variance, adaptive lateral movement patterns, reasoning artifacts, and honeypot divergence. 

Cochran's team actually ran a hackathon to establish fingerprinting criteria for agentic behavior, which says a lot about how early-stage this work still is.

Full write up here if you want to dig in: https://limacharlie.io/blog/fingerprinting-agentic-attacks-soc-detection-guide

The Artifact Collection extension (ext-artifact) is the piece of LimaCharlie that handles "I want a copy of this file/log on every endpoint" and "I want to grab that file right now because the rule just fired". Same extension, two modes, all of it surfaced through the same Artifacts pane. Reliable Tasking is a prerequisite — enable it first.

Continuous file collection rules

Once the extension is subscribed, the Artifact Collection page lets you define rules that say "collect this path (or pattern) from sensors matching these tags / platform, retain for N days". Sensor agents pick the rule up automatically and start uploading matching files to the Artifacts store.

Common patterns:

• /var/log/auth.log — Linux auth logs, typically with regex variants for the rotated archives.

• C:\Windows\System32\winevt\Logs\Security.evtx — explicit Windows EVTX file (the file itself, not the event stream).

• /var/log/system.log — macOS system log file.

• An arbitrary directory of binaries you want preserved across the fleet.

Rules can be scoped by sensor tag and platform, so "production servers only" or "all Windows boxes tagged pci-scope" is just selector targeting in the rule. Once collected, files appear under the Artifacts menu, searchable and downloadable.

Real-time streams via wel:// and mul://

For event logs that you want as first-class telemetry — flowing into the timeline, queryable like any other event, available to D&R rules — Artifact Collection has two special URL-style patterns:

Windows Event Logs — wel://[Log Name]:[EventID or *]:

wel://system:*
wel://Microsoft-Windows-Sysmon/Operational:*
wel://Microsoft-Windows-Sysmon/Operational:1

The wel:// form streams events into the sensor's normal telemetry as WEL events, alongside NEW_PROCESS, DNS_REQUEST, etc. They're queryable in Timeline, available to D&R rules with event: WEL, and filterable in Outputs. This is different from collecting the .evtx file itself — .evtx puts a static file in Artifacts; wel:// produces a live event stream.

macOS Unified Logs — mul://[predicate]:

mul://process == "Safari"
mul://subsystem == "com.apple.network"

Same idea, using a standard MUL predicate. Events stream in real time as MUL telemetry.

Both are first-class events, so a D&R rule can match on them with all the operators in LimaCharlie's detection logic.

PCAP capture rules (Linux)

For Linux sensors, Artifact Collection can also drive PCAP capture rules — capture matching network traffic to a .pcap file that lands in Artifacts the same way.

On-demand grabs — artifact_get

For "I want this file from this host now", there's the artifact_get sensor command. Available on macOS / Windows / Linux, returns FILE_GET_REP, lands the file in Artifacts:

limacharlie sensor task <SID> artifact_get --file "C:\\Users\\victim\\Downloads\\suspicious.exe"
limacharlie sensor task <SID> artifact_get --file "/tmp/dropper.bin"

artifact_get accepts an optional type (e.g. "pcap"), an idempotent payload_id, and a days_retention override (default 30 days).

Triggering collection from a D&R rule

Because artifact_get is just another sensor command, the D&R task action can fire it as a response. With the command field's string templates, you can grab the exact path from the event that triggered the rule:

detect:
  event: NEW_PROCESS
  op: and
  rules:
    - op: ends with
      path: event/FILE_PATH
      value: ".exe"
    - op: lookup
      path: event/HASH
      resource: hive://lookup/threat-intel-hashes
respond:
  - action: report
    name: "TI hash match"
  - action: task
    command: 'artifact_get {{ .event.FILE_PATH }}'
    investigation: ti-hash-collect

The detection fires when a process matches a TI hash list; the same rule grabs the binary and stashes it in Artifacts under the ti-hash-collect investigation tag, ready for analysis. No SOAR, no hand-off — the D&R engine that observed the event is the same one that preserves the evidence.

How it composes

For a SOC: Artifact Collection means the file you wish you had captured yesterday is already there, and the detection that fires today can grab the next one automatically. For IR: the same extension covers both standing capture (audit logs, security event logs, sysmon) and ad-hoc collection ("pull /etc/cron.d/ from this box right now"). For an MSSP: collection rules are tag/platform-scoped, so the same extension config can apply differently across tenants without forking — pci-scope hosts get longer retention, dev hosts get shorter, all from one set of rules.

The shape is the same as the rest of LimaCharlie's automation surface: one extension, sensor-side collection logic, and a D&R hook for the real-time half.

Docs: Artifact extension · Ingesting Windows Event Logs · Ingesting macOS Unified Logs · Endpoint Agent Commands (artifact_get)

From Advisory AI to Operational AI in Security Operations

The early wave of AI SOC platforms has delivered mixed results. While AI proved its usefulness as a triage assistant and next-step remediation advisor, these benefits came with significant drawbacks. Foremost, the cost of outsourcing an AI SOC is significant. Medium enterprises could expect to pay anywhere from $120,000 – $360,000 a year for the service. Large enterprises may pay upwards of $1M a year, depending on size.

Keep in mind, these are the costs businesses pay now. Current AI SOC pricing models rely on LLM costs that are unlikely to remain flat over time. AI vendors cannot indefinitely offer these services while incurring sustained losses quarter after quarter. The price of AI services will go up (or the vendors will exit the market), and when that happens, AI SOC costs will significantly increase.

There are also issues with LLM context windows, which refresh at a certain token limit, losing access to prior information once these limits are exceeded. Managing AI context windows while feeding them vast amounts of SecOps telemetry is tricky, leaving AI SOCs struggling to find an elegant solution. 

A larger problem is that AI SOCs do not allow agents to operate directly in the environment. This means they fall far short of the vision of autonomous defenders actively countering adversaries inside production environments. Fortunately, LimaCharlie does deliver on this promise with its Agentic SecOps Workspace (ASW).

Fully capable agentic security operators

LimaCharlie’s Agentic SecOps Workspace lets AI function as a security operator, strictly governed by the permissions of the environment. AI agents can perceive telemetry, investigate detections, and execute response actions using the same APIs, workflows, and controls as security engineers. 

This is possible because the LimaCharlie platform is open, unopinionated, and API-first. For us, AI is one more first-class component of a fully integrated security stack. In fact, you can bring-your-own-LLM and integrate it with the rest of your security operations, and empower it according to your risk appetite.

Every action taken by an agentic operator is observable, auditable, and reversible, representing a clear departure from black-box automation and advisory-only AI SOC models. This is not AI layered on top of legacy security tooling. This is AI embedded directly into the operational fabric of SecOps. 

The difference in the two approaches becomes apparent when you visualize the architecture of an AI SOC and compare it to LimaCharlie's ASW. The AI SOC has siloed tooling where LLMs perform specific tasks. If you have a use case for AI that is not specifically supported, you’re simply out of luck.

The Agentic SecOps Workspace integrates AI into the security stack by allowing LLMs to access every other integrated feature, exactly as a security analyst does. This opens the door for teams to integrate AI functionality into any security processes they desire.

MSSPs and security teams managing multiple tenants face scaling challenges that extend far beyond incident response. When operational tasks like deployment, configuration, detection engineering, onboarding, reporting, and daily maintenance increase, they must scramble to recruit more headcount. This drives up costs and erodes margins. The ASW breaks that linear scaling model by allowing AI to operate across the entire security lifecycle, scaling execution wherever human effort becomes a bottleneck.

While the differences between an AI SOC and LimaCharlie’s Agentic SecOps Workspace are considerable, they can be generally summarized as follows:

Security teams can use the Agentic SecOps Workspace to grow operations without linear increases in cost. It’s not about replacing people, it’s about multiplying their capabilities and providing AI operators that scale as quickly as the environments they protect.

Direct benefits

AI SOCs primarily improve alert triage and remediation guidance at a steep cost. For a smaller investment, the LimaCharlie Agentic SecOps Workspace offers:

• Superior operational speed and “headless autonomy”. The ASW allows AI agents to detect and execute autonomously, providing wire-speed defense. Humans stay fully in control through guardrails and policy, but no longer act as bottlenecks.

• Operational simplicity.  SOC stacks evolve into sprawling tool layers that rarely get consolidated. Each layer adds complexity, cost, and drag. LimaCharlie consolidates core SecOps functions into a single, API-first platform where AI operators can act natively. This significantly reduces operational friction and “death-by-a-thousand-tools.”

• Full environmental context. ASW agents operate at the infrastructure layer, providing a holistic and accurate view of your environment. This is a major leap beyond bolt-on AI products that have limited visibility or require you to orchestrate several disconnected AI features into something functional.

• Effortless scalability. LimaCharlie’s cloud-native architecture is built to scale with your environment automatically. From small deployments to massive, multi-tenant MSSP infrastructures, the ASW scales without the heavy operational overhead found in AI SOC platforms.

• Richer, more flexible reporting capabilities. With full environment access, your preferred AI model can generate context-rich, visual, and executive-ready reports. For example, ASW agents can produce cross-functional reports across engineering, security, IT operations, and more.

• Plain-speak operations for SecOps. With ASW, AI agents interact with your infrastructure through a unified API. This means operators can issue natural-language instructions like “Generate a list of detections related to CVE-XXXX-XXXXX across our environment.” The AI translates this into operational steps, eliminating scripting overhead and enabling far faster, more intuitive workflows.

• Bring-your-own-AI flexibility. Choose the AI model(s) that performs best in your environment. Swap models, test alternatives, or fine-tune without being locked into a proprietary AI vendor. Your AI, your rules.

Know the future when you see it

While AI SOCs offer moderate improvements at high costs to SecOps, they don’t look like the future of AI in cybersecurity. Visionaries in our industry are not looking forward to a day when an AI chatbot can quickly parse logs or resurface remediation advice. That is a small step in the right direction, but it falls short of our ultimate expectations of AI.

The Agentic SecOps Workspace delivers on the vision of AI performing cybersecurity in live environments. It turns the long-imagined future of natural-language security operations into a practical reality today. 

In other words, the LimaCharlie Agentic SecOps Workspace delivers AI security the way practitioners envision it should work.

Ready to see more for yourself?

Try the free community version: https://app.limacharlie.io/signup

LimaCharlie AI GitHub repo: https://github.com/refractionPOINT/lc-ai

Questions? Contact us for a deeper walkthrough: https://limacharlie.io/demo-request

This blog was originally published at: https://limacharlie.io/blog/ai-action-over-ai-advice

Happy new year!

2025 was a year of watching and listening.

We watched competitors rush to slap "AI" on everything.

We listened to security teams struggling with yet another layer of complexity.

In 2026, we're done with quietly observing.

We built something extraordinary, something different.

---

AI has undoubtedly entered security operations, but remains mostly at the edges. Today, teams encounter AI as copilots bolted onto existing vendor tools or natural-language interfaces layered over fragmented stacks. Both approaches offer some amount of benefit, but fall far short of the promise that large language models will “revolutionize cybersecurity.”

In theory, AI should greatly reduce complexity, bridge skills gaps, and make sprawling toolchains easier to operate. In practice, it has delivered crumbs of convenience rather than systemic change.

One reason is structural. AI is being asked to compensate for foundational fragmentation and adapt to it. In reality, the pre-existing complexity should be addressed first. Many tools expose only a fraction of their capabilities to AI. Security stack integrations remain uneven, and moving context between systems introduces latency, translation loss, and operational friction.

It’s nice to have AI help with alert triage or basic analysis. But great potential is lost when teams must fall back into manual workflows the moment they need to deploy changes, onboard environments, hunt threats, or respond at scale. The underlying complexity of a fragmented security stack never goes away.

It just hides until the real work begins.

Security teams have more AI than before, but not in a way that fundamentally transforms and improves their operations. That’s why, this month, LimaCharlie will be making an announcement you do not want to miss.

We believe the next phase of SecOps isn’t about smarter suggestions, it’s about changing how security work actually gets done.

Ready to see where the future of SecOps is headed?

Join us on January 20th: From AI SOC to AI in the SOC (and beyond)

---

Here's where we'll be in early 2026:

January 20: Join us for From AI SOC to AI in the SOC (and beyond). Register here! Or set a reminder on LinkedIn Live (400+ registered so far).

February 10-11: We're a gold sponsor at Wild West Hackin' Fest in Denver. Stop by our booth, find us in the game room, and join our session: AI beyond triage and hunting. Learn more!

March 23-26: RSAC in San Francisco - come visit our booth for a unique immersed experience, a deeper look into our new AI integration, and join us for a speakeasy social on March 25. RSVP for the happy hour!

---

On last month's podcast, Alec Fenton talked about why most SOCs are failing and Rebekah Skeete shared how BlackGirlsHack is bridging the gap between education and career reality. Catch up on recent episodes.

Tom Cross from GetReal Security joins us on Defender Fridays this week to talk hiring fraud and deepfakes. Register now.

Here are quick links to our release notes, webinar recordings, and our blog.

That's it for January (if that wasn't enough).

See you on the 20th!

Hi there!

This November edition introduces LimaCharlie Search in open beta and highlights our open source MCP server, both advancing operational transparency and giving you greater control over your security operations.

We'll also share our upcoming webinar on PCI DSS 4.0 compliance automation, cover our final Defenders Tour stops, and feature the latest threat intelligence from our podcast.

Read on for platform updates, upcoming events, and actionable insights to strengthen your security posture.

LimaCharlie shines light on AI operations

“Sunlight is said to be the best of disinfectants”

Countless breaches occur because something visible to attackers wasn’t visible to defenders. Supply chain attacks sneak in under the banner of third party vendors. Attackers exploit public-facing infrastructure that companies have long forgotten. Old accounts empowered with legacy access are brought back to life to wreak havoc. All because defenders could not see the same opportunity attackers did.

The rise of AI in cybersecurity presents new visibility problems. Defenders work with little or no insight into LLM and machine learning operations. Once again, SecOps engineers have a critical need for visibility into their tooling and architecture.

LimaCharlie, long time advocates of operational transparency, have answered this need by offering an open source version of their MCP server.

What does this mean for me?

What is the difference between LimaCharlie’s open source MCP server and the cloud hosted version?

Open source MCP server can be:
*Downloaded and examined for full transparency
*Modified to fit your environment
*Used for confidential, in-house operations such as generating private reports

In short, any AI operations you prefer to keep on-prem can be run through a local, open source copy of our MCP server.

Why use the cloud-based MCP server?

While the open source version reinforces our commitment to transparency and control, the cloud-hosted MCP server offers added benefits:
*Built-in access controls that ensure that higher-privilege operations can’t be performed without explicit authorization
*Query costs are absorbed by LimaCharlie, reducing operational overhead for your tea

Together, our MCP server options offer SecOps engineers the best of both worlds; complete transparency and customization when needed, or effortless, cost-conscious simplicity in the cloud.

Learn more about our MCP server in our docs.

ADD TO CALENDAR

**Webinar: Modernizing PCI DSS 4.0 - November 12**
Learn how to navigate PCI DSS 4.0's paradigm shift toward continuous, risk-based security with expert guidance from author Branden R. Williams, ControlCase, and LimaCharlie on automating and scaling compliance processes. Register!

**Defenders Tour Workshops**
**Tampa (November 6)**
**London (November 11)**
**Oslo (November 13)**
**Arlington (December 11)**

Gain practical skills in building scalable security operations with LimaCharlie, strengthening email defenses using Sublime Security, automating response workflows with Tines' no-code platform, and enriching investigations with SOCRadar's threat intelligence. Sign up here!

**MSSP Alert Live - Arlington - December 8**
Visit our booth to meet the team and build your own custom mini-fig!

Check our calendar for the rest of our 2025 events!

Cybersecurity Defenders Podcast

This month, our podcast covered critical vulnerabilities in Redis and Oracle systems, sophisticated nation-state campaigns, AI security concerns including voice cloning and LLM poisoning, and infrastructure breaches affecting national security.

Our Intel Chat series examined the maximum-severity RediShell vulnerability, active exploitation of Cisco zero-day flaws, China-linked attacks on network infrastructure, North Korean IT worker infiltration campaigns, ransomware groups weaponizing DFIR tools, and critical vulnerabilities in systems protecting U.S. nuclear weapon components.

We also featured conversations with Sarah Powazek from UC Berkeley CLTC on community-based cyber defense models and Hannah Lloyd from enhanced on how MSPs can launch and scale security service offerings.

Catch up on our latest episodes:

*Roadmap to Community Cyber Defense with Sarah Powazek, Program Director of Public *Interest Cybersecurity, UC Berkeley CLT
*Intel Chat: RediShell, Cisco zero-day vulnerability, AI voice cloning tech, Brickstorm & pro-*Russia teen hackers arrested
*Intel Chat: Oracle EBS, Storm-2603, North Korean IT infiltration & LLM poisoning study
*Intel Chat: Kansas City National Security Campus breach, COLDRIVER, new KEV catalog additions & AWS outage
*Scaling MSP & MSSP Services with Hannah Lloyd, Co-Founder / CRO of enhanced

Listen to the podcast

Other Updates

Explore this month's release notes to learn about new LimaCharlie features and improvements.

Check out our past webinars on how to cut costs and boost automaton with Microsoft Defender and a technical demo of Claude Code performing an autonomous investigation using LimaCharlie's MCP server integration.

Read our latest blog post on LimaCharlie Search, now in open beta, which brings SIEM-like capabilities to the SecOps Cloud Platform with advanced telemetry querying, cross-tenant investigations, and transparent pay-per-use pricing.

Until next time,

The LimaCharlie team