Can I run commands across thousands of servers at once?

Yes, the skill supports LimaCharlie selectors which allow you to target groups of sensors by platform, tags, or specific attributes for fleet-wide operations.

Which platforms are supported for sensor tasking?

This skill supports EDR agents running on Windows, Linux, macOS, and Chrome. It automatically filters out non-taskable USP adapters.

How does this skill handle offline sensors?

It utilizes 'Reliable Tasking' to queue commands with a configurable time-to-live (TTL), ensuring tasks are delivered and executed as soon as the sensor reconnects.

Is it possible to automate the response to a sensor task?

Yes, the skill can programmatically create Detection & Response (D&R) rules prior to tasking to automatically process, filter, and report results.

LimaCharlie Sensor Tasking

Name: LimaCharlie Sensor Tasking
Author: refractionPOINT

byrefractionPOINT

•

安全与测试

Orchestrates real-time command execution and forensic data collection across LimaCharlie EDR sensors for incident response and fleet management.

关于

This skill enables Claude to interact directly with LimaCharlie EDR agents, allowing users to perform live incident response, forensic data collection, and fleet-wide operations. It effectively manages the complexities of offline agents through reliable tasking and automates response collection using LCQL queries and Detection & Response (D&R) rules. Whether you need to isolate a compromised host, query running processes, or perform memory forensics across thousands of servers, this skill provides the structured workflow needed to maintain endpoint visibility and control.

主要功能

Automated response collection via LCQL queries and D&R rules
Advanced forensic acquisition including YARA scans and memory mapping
Reliable tasking for both offline and online sensors with configurable TTL
Fleet-wide operations using sensor selectors, tags, and platform filters
Live response capabilities including process management and network isolation
3 GitHub stars

使用场景

Isolating infected hosts and killing malicious process trees during active incidents
Executing automated YARA scans on specific directories across all Windows endpoints
Collecting software inventory or OS versions across an entire global server fleet

关于

主要功能

Automated response collection via LCQL queries and D&R rules
Advanced forensic acquisition including YARA scans and memory mapping
Reliable tasking for both offline and online sensors with configurable TTL
Fleet-wide operations using sensor selectors, tags, and platform filters
Live response capabilities including process management and network isolation
3 GitHub stars

使用场景

Isolating infected hosts and killing malicious process trees during active incidents
Executing automated YARA scans on specific directories across all Windows endpoints
Collecting software inventory or OS versions across an entire global server fleet