Can I run commands across thousands of servers at once?

Yes, the skill supports LimaCharlie selectors which allow you to target groups of sensors by platform, tags, or specific attributes for fleet-wide operations.

Which platforms are supported for sensor tasking?

This skill supports EDR agents running on Windows, Linux, macOS, and Chrome. It automatically filters out non-taskable USP adapters.

How does this skill handle offline sensors?

It utilizes 'Reliable Tasking' to queue commands with a configurable time-to-live (TTL), ensuring tasks are delivered and executed as soon as the sensor reconnects.

Is it possible to automate the response to a sensor task?

Yes, the skill can programmatically create Detection & Response (D&R) rules prior to tasking to automatically process, filter, and report results.

LimaCharlie Sensor Tasking

Name: LimaCharlie Sensor Tasking
Author: refractionPOINT

byrefractionPOINT

•

보안 및 테스팅

Orchestrates real-time command execution and forensic data collection across LimaCharlie EDR sensors for incident response and fleet management.

소개

This skill enables Claude to interact directly with LimaCharlie EDR agents, allowing users to perform live incident response, forensic data collection, and fleet-wide operations. It effectively manages the complexities of offline agents through reliable tasking and automates response collection using LCQL queries and Detection & Response (D&R) rules. Whether you need to isolate a compromised host, query running processes, or perform memory forensics across thousands of servers, this skill provides the structured workflow needed to maintain endpoint visibility and control.

주요 기능

Automated response collection via LCQL queries and D&R rules
Advanced forensic acquisition including YARA scans and memory mapping
Reliable tasking for both offline and online sensors with configurable TTL
Fleet-wide operations using sensor selectors, tags, and platform filters
Live response capabilities including process management and network isolation
3 GitHub stars

사용 사례

Isolating infected hosts and killing malicious process trees during active incidents
Executing automated YARA scans on specific directories across all Windows endpoints
Collecting software inventory or OS versions across an entire global server fleet

소개

주요 기능

Automated response collection via LCQL queries and D&R rules
Advanced forensic acquisition including YARA scans and memory mapping
Reliable tasking for both offline and online sensors with configurable TTL
Fleet-wide operations using sensor selectors, tags, and platform filters
Live response capabilities including process management and network isolation
3 GitHub stars

사용 사례

Isolating infected hosts and killing malicious process trees during active incidents
Executing automated YARA scans on specific directories across all Windows endpoints
Collecting software inventory or OS versions across an entire global server fleet