LC is an Open Source, cross-platform (Windows, MacOS, Linux ++), realtime Endpoint Detection and Response sensor. The extra-light sensor, once installed on a system provides Flight Data Recorder type information (telemetry on all aspects of the system like processes, DNS, network IO, file IO etc).

The configuration of the sensor can be updated at runtime to send back specific types of events. The sensor also caches the detailed events to be sent back to the cloud on request. In addition to advanced "passive" collection of telemetry, the sensor can also be tasked with many investigation actions (like reading process memory) and mitigations (like network-isolate the host).

Ultimately, LC is a highly configurable platform to deliver endpoint capabilities.

Main support and development is provided by Refraction Point and its LimaCharlie Enterprise (LCE) platform. The LCE platform differs from the Open Source community branch by its more robust architecture, larger feature set, complete automation package and its management interface (fully REST controlled and appliance-delivered).

The community edition is still available through GitHub but it is no longer officially supported.

Talk to us on the LimaCharlie Slack Community

Stay up to date with new features and detection modules: @rp_limacharlie

For more direct enquiries, contact us at [email protected]

*** Due to the sensitivity of their security toolset, several other organizations prefer to keep a lower profile. Contact us if you would like to inquire about specific organization types of using LC. ***

"In an endless sea of endpoint agents, LC stands head-and-shoulders above competing open-source and fee-based tools at a fraction of the operating cost. LC's APT detection, threat mitigation, and interoperability are best-in-class and this is why its our agent of choice."

Live Malware Analysis performed thinking Out of the (Sand)Box.

LIMA CHARLIE's design and implementation is based on the following core values:

• Reduce friction for the development of detections and operations.
• Single cohesive platform across Operating Systems.
• Minimize performance impact on host.