LimaCharlie Expert

概要

Acts as a central knowledge hub for the LimaCharlie SecOps platform, offering detailed insights into telemetry sources, detection engines, and automation workflows. This skill facilitates the configuration of sensors and adapters, the creation of sophisticated Detection and Response (D&R) rules, and the integration of serverless extensions for advanced security logic. By mapping component interconnections and data flows, it helps users navigate the platform’s capabilities—from hunting with LCQL to implementing complex automated playbooks—ensuring a cohesive and efficient security operation.

主な機能

• Guidance on implementing stateless and stateful Detection and Response (D&R) rules.
• Architectural mapping of telemetry sources including endpoint sensors and cloud adapters.
• 0 GitHub stars
• Patterns for automated response actions, sensor commands, and network isolation.
• Query construction for threat hunting using LimaCharlie Query Language (LCQL).
• Orchestration of serverless extensions and visual playbooks for security automation.

ユースケース

• Designing end-to-end endpoint detection and response (EDR) workflows.
• Onboarding and normalizing cloud-native telemetry from AWS, Azure, or SaaS logs.
• Building automated security playbooks with external enrichment via VirusTotal or GreyNoise.