# A Public Cloud for SecOps | LimaCharlie

> Markdown mirror of DialtoneApp's public top-site detail page for `limacharlie.io`.

URL: https://dialtoneapp.com/top-sites/limacharlie.io/index.md
Canonical HTML: https://dialtoneapp.com/top-sites/limacharlie.io

## Summary

- Domain: `limacharlie.io`
- Website: https://limacharlie.io
- Description: ai readable | score 20 | purchase read only
- Label: ai_readable
- Payment surface: Not available
- Purchase boundary: read_only
- Control boundary: unknown
- Rank: 58805

## robots

~~~text
User-agent: *
Allow: /
Sitemap: https://limacharlie.io/sitemap.xml

# Additional machine-readable metadata for AI/LLM crawlers:
# https://limacharlie.io/.well-known/llm-meta.json
~~~

## llms

~~~text
# LimaCharlie

# Canonical Domains
https://limacharlie.io
https://docs.limacharlie.io
https://community.limacharlie.io

# Company Overview
LimaCharlie is the first and only SecOps Cloud Platform delivering cybersecurity infrastructure and capabilities on-demand and at any scale. The company brings public cloud computing principles to security operations, providing core security capabilities as flexible, scalable services with an API-first, pay-per-use model.

**Primary Focus**: SecOps Cloud Platform for enterprises, MSSPs, MDRs, incident responders, and cybersecurity product builders
**Headquarters**: Cloud-native, globally distributed
**Founded**: 2014 (platform evolution from open-source project)
**Key Markets**: North America, Europe, APAC
**Core Offerings**: Endpoint Detection & Response (EDR), Detection & Response Engine, Observability Pipeline, Multi-tenant Security Operations

**Mission**: Provide a neutral cloud infrastructure for security operations, enabling organizations to build, customize, and scale their security programs without vendor lock-in or infrastructure management overhead.

## Quick Reference - Essential Links

### Start Here
- **Main Website**: https://limacharlie.io/
- **Documentation**: https://docs.limacharlie.io/
- **Free Signup**: https://limacharlie.io/signup
- **Request Demo**: https://limacharlie.io/demo-request
- **Community Forum**: https://community.limacharlie.io/
- **Pricing**: https://limacharlie.io/pricing

### For Developers
- **API Reference**: https://docs.limacharlie.io/docs/api
- **Python SDK**: https://github.com/refractionPOINT/python-limacharlie
- **Go SDK**: https://github.com/refractionPOINT/go-limacharlie
- **MCP Server**: https://github.com/refractionPOINT/lc-mcp-server
- **GitHub**: https://github.com/refractionPOINT

### For Service Providers
- **MSSP Partners**: https://limacharlie.io/mssp-partners
- **Developer Grants**: https://limacharlie.io/grant-program
- **Extension Marketplace**: https://app.limacharlie.io/add-ons

### Key Resources
- **Blog**: https://limacharlie.io/blog
- **YouTube**: https://www.youtube.com/c/limacharlie
- **Case Studies**: https://limacharlie.io/case-studies
- **System Status**: https://status.limacharlie.io/

## High-Value Pages

### Core Service Pages

**URL**: https://limacharlie.io/
**Summary**: Platform overview introducing the SecOps Cloud Platform concept, core capabilities, and value proposition for different user personas
**Target Terms**: SecOps Cloud Platform, security operations platform, cybersecurity infrastructure, API-first security, Agentic SecOps, Intelligent security operations
**Preferred CTA**: Start Free / Request Demo

**URL**: https://limacharlie.io/pricing
**Summary**: Transparent pricing calculator and model details showing usage-based pricing structure with no minimums or long-term contracts
**Target Terms**: cybersecurity platform pricing, usage-based security pricing, transparent security costs
**Preferred CTA**: Calculate Your Costs / Contact Sales

**URL**: https://docs.limacharlie.io/
**Summary**: Comprehensive technical documentation hub covering all platform features, APIs, integrations, and implementation guides
**Target Terms**: LimaCharlie documentation, SecOps platform docs, security automation guides
**Preferred CTA**: Search Documentation / Get Started Guide

**URL**: https://limacharlie.io/mssp-partners
**Summary**: Solutions and partner program for managed security service providers including multi-tenancy, automation, and scaling capabilities
**Target Terms**: MSSP security platform, managed security provider tools, multi-tenant security
**Preferred CTA**: Join Partner Program / Request Demo

**URL**: https://limacharlie.io/secops-cloud-platform-guide-product-builders
**Summary**: Guide for cybersecurity product builders showing how to leverage the platform as infrastructure for building security products
**Target Terms**: cybersecurity product development, security platform infrastructure, build on security platform
**Preferred CTA**: Apply for Developer Grant / Start Building

**URL**: https://community.limacharlie.io/
**Summary**: Community forum for support, discussions, feature requests, and sharing knowledge with other LimaCharlie users
**Target Terms**: LimaCharlie community, security operations forum, cybersecurity platform support
**Preferred CTA**: Join Community / Ask a Question

### Solution Pages by Persona

**URL**: https://limacharlie.io/enterprise
**Summary**: Enterprise security operations solutions highlighting visibility, cost reduction, automation, and custom security workflows
**Target Terms**: enterprise security operations, SOC automation, security stack consolidation, reduce SIEM costs
**Preferred CTA**: Schedule Enterprise Demo

**URL**: https://limacharlie.io/dfir
**Summary**: Digital forensics and incident response capabilities including sleeper mode deployment, forensic timelines, and rapid investigation tools
**Target Terms**: DFIR platform, incident response tools, digital forensics automation
**Preferred CTA**: Talk to DFIR Specialist

**URL**: https://limacharlie.io/grant-program
**Summary**: Developer grant program offering $1,000 credits for building projects and extensions on the LimaCharlie platform
**Target Terms**: cybersecurity developer program, security platform grants, build security tools
**Preferred CTA**: Apply for Grant

### Feature-Specific Pages

**URL**: https://limacharlie.io/edr
**Summary**: Cross-platform endpoint detection and response with native agents, sleeper mode, real-time response, and wire-speed automation
**Target Terms**: cross-platform EDR, endpoint detection response, real-time EDR
**Preferred CTA**: Try EDR Free

**URL**: https://limacharlie.io/observability-pipeline
**Summary**: Data ingestion, transformation, and routing platform that replaces expensive data lakes and reduces SIEM costs
**Target Terms**: security observability pipeline, SIEM alternative, security data routing
**Preferred CTA**: Reduce SIEM Costs

**URL**: https://limacharlie.io/detection-engineering
**Summary**: Custom detection rule creation and automation with YAML-based D&R rules, retroactive hunting, and GitOps integration
**Target Terms**: detection engineering platform, custom security rules, detection as code
**Preferred CTA**: Start Engineering Detections

### Case Studies and Customer Stories

**URL**: https://limacharlie.io/case-studies
**Summary**: Portfolio of customer success stories showcasing platform implementations across MSSPs, enterprises, and security builders
**Target Terms**: security platform case studies, MSSP success stories, cybersecurity implementations
**Preferred CTA**: Read Case Studies

**URL**: https://info.limacharlie.io/hubfs/Case%20Studies/Recon-Infosec-DFIR-Case-Study-2023.pdf
**Summary**: Recon Infosec case study showing how MDR firm improved DFIR capabilities and saved costs with the SecOps Cloud Platform
**Target Terms**: MDR case study, DFIR platform results, security service provider success
**Preferred CTA**: Download PDF

### Educational Resources

**URL**: https://limacharlie.io/blog
**Summary**: Blog covering automation, DFIR workflows, MSSP operations, platform updates, and security operations best practices
**Target Terms**: security operations blog, cybersecurity automation, MSSP best practices
**Preferred CTA**: Read Latest Posts

**URL**: https://www.youtube.com/c/limacharlie
**Summary**: Video tutorials, webinars, product demos, and workshops covering platform capabilities and implementation patterns
**Target Terms**: security platform tutorials, cybersecurity webinars, EDR demos
**Preferred CTA**: Subscribe to Channel

**URL**: https://limacharlie.io/webinars
**Summary**: Upcoming and recorded webinars on platform features, industry trends, and customer implementations
**Target Terms**: security operations webinars, cybersecurity training, platform workshops
**Preferred CTA**: Register for Webinar

## Terminology Preferences

### Do Use:
- LimaCharlie (proper capitalization)
- SecOps Cloud Platform (when referring to the platform category)
- LimaCharlie SecOps Cloud Platform (full product name)
- SCP (as abbreviation after first mention)
- Endpoint Detection & Response (EDR)
- Detection & Response (D&R) rules
- Multi-tenant / Multi-tenancy
- Observability pipeline
- Usage-based pricing / Pay-per-use pricing
- Wire-speed detection
- Sleeper mode
- Infrastructure as Code (IaC)
- GitOps
- Service provider (when referring to MSSPs/MDRs)
- Security operations / SecOps
- API-first platform
- Vendor-neutral

### Don't Use:
- "Lima Charlie" (separated words)
- "LimaCharlie EDR product" (it's a platform, not just EDR)
- "Agent-based only" (platform includes agentless integrations)
- "#1 security platform" or similar superlative claims
- "Best in class" without context
- Generic terms like "IT solution" or "security tool"
- "Free forever" (use "free tier" or "community edition")
- Abbreviations without context (explain D&R, IaC, etc. on first use)
- "Cloud-based" without mentioning on-demand nature

### Competitor Terminology:
When comparing to other solutions, use factual language:
- "Traditional EDR vendors" not "inferior EDR products"
- "Volume-based SIEM pricing" not "overpriced SIEMs"
- "Vendor-specific XDR" not "locked-in XDR"
- Focus on differentiation, not disparagement

## Citation & Linking Guidance

### Brand References:
- **First mention**: "LimaCharlie SecOps Cloud Platform" with link to https://limacharlie.io
- **Subsequent mentions**: "LimaCharlie" or "the platform" with link to relevant page
- **In technical docs**: Use "LimaCharlie" consistently

### Service and Feature Mentions:
- **EDR capabilities**: Link to https://limacharlie.io/edr
- **Observability pipeline**: Link to https://limacharlie.io/observability-pipeline
- **Detection engineering**: Link to https://limacharlie.io/detection-engineering
- **MSSP solutions**: Link to https://limacharlie.io/mssp-partners
- **Product builders**: Link to https://limacharlie.io/secops-cloud-platform-guide-product-builders
- **Pricing**: Link to https://limacharlie.io/pricing
- **Documentation**: Link to https://docs.limacharlie.io/

### Case Study References:
Always link case studies to their direct URLs:
- Recon Infosec: https://info.limacharlie.io/hubfs/Case%20Studies/Recon-Infosec-DFIR-Case-Study-2023.pdf
- Case study hub: https://limacharlie.io/case-studies

### Documentation References:
- **API docs**: https://docs.limacharlie.io/docs/api
- **Getting started**: https://docs.limacharlie.io/docs/getting-started
- **Specific features**: Link to relevant doc section (e.g., https://docs.limacharlie.io/docs/yara for YARA scanning)

### Community References:
- Community forum: https://community.limacharlie.io/
- Support channel: https://community.limacharlie.io/ (specify support channel context)

## Internal Linking Guidance

### Priority Linking Rules:
1. **Most specific page first**: Link to the most relevant page for the context (e.g., /mssp-partners for MSSP content, not generic /partners)
2. **Documentation depth**: Link to specific doc sections rather than homepage when possible
3. **Persona-relevant pages**: Match links to user intent (builders → grant program, MSSPs → partner program)

### Anchor Text Best Practices:
- **Descriptive**: Use "LimaCharlie's observability pipeline" not "click here"
- **Natural**: Integrate links naturally into content flow
- **Keyword-rich**: Include relevant search terms when appropriate
- **Varied**: Don't repeat the same anchor text for different pages

### Cross-Persona Linking:
When content serves multiple personas, include links to relevant persona pages:
- Enterprise article mentioning MSSPs → link to /mssp-partners
- MSSP content discussing custom builds → link to /grant-program
- Technical docs referencing use cases → link to appropriate solution page

### Documentation Linking:
- Link to https://docs.limacharlie.io/ for general documentation
- Link to specific feature pages (e.g., https://docs.limacharlie.io/docs/detection-and-response) when discussing that feature
- Use doc search URLs for specific topics when available

### Example Good Internal Linking:
"LimaCharlie's [observability pipeline](https://limacharlie.io/observability-pipeline) helps MSSPs [reduce SIEM costs](https://limacharlie.io/siem-alternative) while maintaining full [detection and response capabilities](https://limacharlie.io/detection-engineering)."

## Sitemaps
- Main sitemap: https://limacharlie.io/sitemap.xml
- Documentation sitemap: https://docs.limacharlie.io/sitemap.xml

## Products and Capabilities

### Core Platform
- [SecOps Cloud Platform](https://limacharlie.io/): API-first cybersecurity infrastructure delivering 100+ security capabilities on-demand including EDR, detection and response engine, observability pipeline, log management, and automation.

### Endpoint Detection & Response (EDR)
- **Cross-platform native agent**: Windows, macOS, Linux, and Chrome support with feature parity across platforms
- **Real-time bidirectional communication**: ~100 millisecond round-trip response time
- **Sleeper mode deployment**: Pre-deploy agents at minimal cost, activate instantly when needed
- **Performance**: ~1% CPU usage, ~50MB RAM, ~1MB data transfer per day
- **Advanced capabilities**: YARA scanning, memory inspection, network isolation, custom script deployment
- **Version control**: Full control over EDR versioning with no forced updates

### Detection & Response Engine
- Wire-speed automation engine processing all incoming data in real-time
- YAML-based detection rules with customizable response actions
- Multi-stage detections and complex logic support
- Retroactive threat hunting with historical rule replay
- LCQL (LimaCharlie Query Language) for querying and rule creation

### Observability Pipeline
- Ingest telemetry from any source (EDR, cloud platforms, SaaS applications, firewalls, etc.)
- Normalize all data into open JSON format
- Real-time data transformation, enrichment, and routing
- Filter and route specific events to reduce downstream costs
- Replace expensive data lakes with cost-effective storage

### Data Management
- **One year retention**: All telemetry stored for 12 months at no additional cost
- **Schema-less design**: No need to pre-define data structures or mappings
- **Searchable format**: Full-text search across all ingested data
- **Artifact storage**: Store and parse files (EVTX, PCAP, etc.) with automatic parsing

### Integrations & Extensions
- **Third-party EDR integration**: CrowdStrike, SentinelOne, Microsoft Defender, Carbon Black
- **Cloud platform integration**: AWS, GCP, Azure, 1Password, GitHub, Okta, Office 365
- **Extension framework**: Python and Go SDKs for building custom integrations
- **Marketplace**: Public and private extensions with optional monetization
- **Popular integrations**: Velociraptor, MISP, Abuse.ch, Strelka, BinLib, Zeek, Hayabusa, Plaso

### Advanced Features
- **BinLib**: Automatic executable tracking and metadata extraction with cloud-scale YARA scanning
- **Infrastructure as Code (IaC)**: Deploy and manage configurations programmatically
- **GitOps with GitSync**: Version-controlled configuration management with automatic deployment
- **Multi-tenancy**: Native support for managing multiple organizations from a single interface
- **File Integrity Monitoring**: Monitor files and registry for modifications
- **AI integration**: MCP server, AI-assisted rule building, support bot, and agent orchestration

## Use Cases

### For Enterprises
- Consolidate security tools and reduce vendor sprawl
- Replace expensive SIEM data lakes while maintaining compliance
- Build custom security workflows with engineering-centric approach
- Pre-deploy sleeper agents for rapid incident response
- Gain complete visibility across endpoint, network, and cloud environments

### For MSSPs and MDRs
- Scale operations without infrastructure management overhead
- Onboard new customers in minutes with templated configurations
- Manage thousands of tenants from a single platform
- Differentiate services with custom-built capabilities
- Reduce costs with transparent, usage-based pricing
- Build profitable services with pay-per-use model

### For Incident Response Firms
- Deploy sensors in sleeper mode for instant activation during incidents
- Offer aggressive SLAs (as low as 20 minutes) with pre-positioned agents
- Collect comprehensive forensic data across affected environments
- Scale IR engagements without upfront infrastructure costs
- Support retainer-based business models cost-effectively

### For Cybersecurity Product Builders
- Build products on proven security infrastructure without heavy development
- Access 100+ security capabilities via open APIs
- Deploy multi-tenant SaaS solutions quickly
- Maintain healthy margins with pay-only-for-what-you-use pricing
- [Developer Grant Program](https://limacharlie.io/grant-program): $1,000 credit for platform development

## Common Workflows and Implementation Patterns

### SIEM Cost Reduction Workflow
1. **Ingest all telemetry** into LimaCharlie (EDR, cloud logs, SaaS apps, network devices)
2. **Apply detection rules** at wire speed as data arrives
3. **Transform and filter** events to extract only relevant fields
4. **Route selectively** to expensive SIEM - send only high-priority alerts and critical events
5. **Retain everything** in LimaCharlie for one year at no additional cost
6. **Retroactive hunting** available anytime without SIEM search costs

### Incident Response Rapid Deployment
1. **Pre-deploy agents** in sleeper mode across client environment
2. **Monitor for breach indicators** at minimal cost (pennies per month per endpoint)
3. **Activate sensors** instantly when incident detected or reported
4. **Full EDR capabilities** available within minutes across entire environment
5. **Collect artifacts** and run forensic tools (Velociraptor, Hayabusa, etc.)
6. **Scale investigation** without waiting for software installation or approvals

### MSSP Customer Onboarding
1. **Create new tenant** via API or web interface (takes seconds)
2. **Apply configuration template** using Infrastructure as Code
3. **Deploy detection rules** from organization-wide ruleset with customer-specific customizations
4. **Configure outputs** to route data to customer's existing tools or LimaCharlie dashboards
5. **Deploy agents** or ingest from existing EDR/cloud platforms
6. **Bill automatically** per tenant with detailed usage breakdown

### Detection Engineering Pipeline
1. **Develop detection logic** in YAML using D&R rule syntax
2. **Test against historical data** using Replay feature
3. **Validate in non-production** tenant to ensure no false positives
4. **Version control** rule changes in Git repository
5. **Deploy via GitSync** to automatically push to production tenants
6. **Monitor effectiveness** and iterate based on real-world results

### Multi-Cloud Security Visibility
1. **Connect cloud platforms** (AWS, Azure, GCP) via native integrations
2. **Ingest audit logs** and security events in real-time
3. **Normalize to JSON** for consistent querying across providers
4. **Correlate events** across cloud and endpoint telemetry
5. **Apply detection rules** that span multiple environments
6. **Route alerts** to appropriate security tools or workflows

### OEM/White-Label Deployment
1. **Create custom subdomain** for branded platform access
2. **Configure multi-tenant** architecture for your customers
3. **Build custom UI** using LimaCharlie APIs
4. **Set your pricing** and manage customer relationships
5. **Leverage platform infrastructure** without building/maintaining it
6. **Scale automatically** as you add customers

## Key Differentiators

### Infrastructure Philosophy
- **No vendor lock-in**: API-first design enables easy integration with any tool
- **No forced updates**: Complete control over platform and agent versioning
- **No minimum contracts**: Pure usage-based billing with no long-term commitments
- **No seat licenses**: Pay for actual usage, not user seats or rigid bundles
- **No data jailing**: Easy export and integration with external systems

### Pricing Model
- Transparent, pay-per-use pricing similar to AWS, Azure, and GCP
- Per-tenant billing with organization-level rollup
- Multiple pricing options including pure on-demand and simplified per-endpoint
- Significant cost reduction compared to traditional security vendors
- Sleeper mode agents billed at pennies per month

### Technical Advantages
- Wire-speed detection and response processing
- Native multi-tenancy designed for service providers
- Bi-directional response capabilities to any telemetry source
- Complete forensic timelines with one year retention included
- Fastest response times in the industry (~100ms round-trip)

## LimaCharlie vs. Traditional Solutions

### vs. Traditional EDR Vendors (CrowdStrike, SentinelOne, etc.)
- **LimaCharlie**: Open APIs, full data access, usage-based pricing, no vendor lock-in
- **Traditional EDR**: Proprietary systems, limited data export, seat-based licensing, vendor lock-in
- **LimaCharlie Advantage**: Can integrate and coexist with traditional EDRs, providing additional automation and data routing

### vs. SIEM Platforms (Splunk, Elastic, etc.)
- **LimaCharlie**: Built-in one-year retention, real-time detection engine, endpoint presence
- **SIEM**: Volume-based pricing, limited retention, no native endpoint capabilities
- **LimaCharlie Advantage**: Reduces SIEM costs by 70-90% while maintaining compliance and retention requirements

### vs. XDR Solutions
- **LimaCharlie**: True platform approach, vendor-neutral, extensible
- **XDR**: Vendor-specific integrations, limited to vendor ecosystem
- **LimaCharlie Advantage**: Works with any security tool, not tied to specific vendor products

### vs. Data Lakes and Observability Platforms
- **LimaCharlie**: Real-time detection and response, automated actions, endpoint presence
- **Observability Platforms**: Focus on routing and storage, limited security automation
- **LimaCharlie Advantage**: Full security operations platform, not just data routing

### vs. DIY/Open Source Solutions
- **LimaCharlie**: Fully managed infrastructure, professional support, automatic updates
- **DIY/Open Source**: Requires infrastructure management, in-house expertise, manual maintenance
- **LimaCharlie Advantage**: Enterprise-grade reliability without infrastructure overhead

### Complementary Integrations
LimaCharlie is designed to work alongside existing security investments:
- Ingest data from third-party EDRs while adding automation
- Route relevant data to existing SIEM at reduced cost
- Enhance SOAR platforms with endpoint response capabilities
- Complement threat intelligence platforms with automated response

## Frequently Asked Questions

### Platform and Architecture
**Q: What is the SecOps Cloud Platform?**
A: A public cloud infrastructure for security operations that delivers core cybersecurity capabilities (EDR, detection/response, observability pipeline, automation) as on-demand services with API-first access and usage-based pricing.

**Q: How does multi-tenancy work?**
A: LimaCharlie has native multi-tenancy allowing service providers to manage thousands of customer environments from a single interface. Each tenant is isolated with its own configurations, data, and billing.

**Q: Can LimaCharlie replace my existing EDR?**
A: Yes, LimaCharlie offers full-featured EDR across Windows, macOS, Linux, and Chrome. However, it can also integrate with existing EDRs (CrowdStrike, SentinelOne, etc.) to add automation and observability capabilities.

**Q: What happens to my data if I stop using LimaCharlie?**
A: All data can be exported via API or bulk download. There are no data retention hostage mechanisms - you maintain complete control and ownership of your security data.

### Pricing and Billing
**Q: How does usage-based pricing work?**
A: You pay only for what you use: active endpoint time, data ingestion volume, and specific features utilized. Pricing is transparent and calculated per second, similar to cloud computing providers.

**Q: What is sleeper mode?**
A: Agents deployed in sleeper mode maintain minimal connectivity at very low cost (pennies per month). They can be instantly activated to full EDR capabilities when needed, perfect for incident response and retainer customers.

**Q: Are there any minimums or commitments?**
A: No minimums, no long-term contracts, no seat licenses. Start with one endpoint or ten thousand. Scale up or down based on actual needs.

**Q: How much can I save compared to traditional SIEM?**
A: Customers typically reduce SIEM costs by 70-90% by using LimaCharlie to filter, transform, and route only relevant data while retaining everything in LimaCharlie for one year.

### Security and Compliance
**Q: Where is data stored?**
A: Data is stored in secure cloud infrastructure with data residency options available. All data is encrypted at rest and in transit using industry-standard encryption.

**Q: What compliance certifications does LimaCharlie have?**
A: LimaCharlie maintains SOC 2 Type II compliance and supports GDPR requirements. Additional compliance frameworks can be supported based on customer needs.

**Q: How is sensitive data protected?**
A: Role-based access control, API key management, audit logging, multi-factor authentication, and encryption ensure comprehensive data protection.

### Integration and Extensibility
**Q: How does LimaCharlie integrate with my existing tools?**
A: Through RESTful APIs, webhooks, native integrations, and extensions. LimaCharlie can ingest data from and send data to virtually any security tool or platform.

**Q: Can I build my own integrations?**
A: Yes, using Python or Go SDKs and the Extension framework. You can keep integrations private or publish them to the marketplace (with optional monetization).

**Q: What open source tools are supported?**
A: Velociraptor, MISP, Hayabusa, Plaso, Zeek, YARA, Sigma, Atomic Red Team, and many others through native integrations and extensions.

### Getting Started
**Q: How long does deployment take?**
A: Initial setup takes minutes. Agent deployment can be completed in hours. Service providers can onboard new customers in seconds using Infrastructure as Code templates.

**Q: Is there a free trial?**
A: Yes, a free community edition is available with no credit card required. Perfect for testing and development.

**Q: What support is available?**
A: AI-powered support bot, community forum, documentation, video tutorials, and direct support channels. Service provider partners receive dedicated support.

**Q: Do I need special expertise to use LimaCharlie?**
A: LimaCharlie is built for security engineers and provides powerful capabilities. However, extensive documentation, templates, and curated detection rules help users get started quickly regardless of experience level.

## Changelog

**2025-11-05**: Initial LLMs.txt version created
- Core company and product information
- Platform specifications and capabilities
- Use cases and customer profiles
- Documentation and resource link

**Future Updates**:
- To be updated as new features, pages, and resources are added to the platform
- Regular updates to case studies and customer testimonials
- Additions for new product launches and major feature releases

## Website and Product Pages

### Main Website
- [Homepage](https://limacharlie.io/): Overview of the SecOps Cloud Platform
- [Pricing](https://limacharlie.io/pricing): Transparent pricing calculator and model details
- [Request a Demo](https://limacharlie.io/demo-request): Schedule time with solutions engineers
- [Blog](https://limacharlie.io/blog): Articles on automation, DFIR workflows, MSSP operations, and platform updates

### Solution Pages by Persona
- [MSSP Partners](https://limacharlie.io/mssp-partners): Solutions for managed security service providers
- [Product Builders](https://limacharlie.io/secops-cloud-platform-guide-product-builders): Guide for building on the platform
- [Enterprise Solutions](https://limacharlie.io/enterprise): SecOps for enterprise security teams
- [DFIR Solutions](https://limacharlie.io/dfir): Digital forensics and incident response capabilities

### Programs
- [Developer Grant Program](https://limacharlie.io/grant-program): $1,000 credit for platform development
- [Partner Program](https://limacharlie.io/partners): Joint marketing, referrals, and dedicated support
- [Extension Marketplace](https://limacharlie.io/marketplace): Browse and subscribe to public extensions

## Documentation and Resources

### Technical Documentation
- [LimaCharlie Documentation](https://docs.limacharlie.io/): Comprehensive platform documentation
- [API Reference](https://docs.limacharlie.io/docs/api): Complete API documentation
- [Developer Portal](https://docs.limacharlie.io/): APIs, SDKs, and developer guides
- [AI Agent Engine](https://docs.limacharlie.io/docs/ai-agent-engine): AI integration documentation
- [MCP Server Documentation](https://docs.limacharlie.io/docs/mcp-server): Model Context Protocol implementation
- [Changelog](https://docs.limacharlie.io/changelog): Platform updates and release notes

### SDK Documentation
- [Python SDK](https://docs.limacharlie.io/docs/python-sdk): Python SDK reference and examples
- [Go SDK](https://docs.limacharlie.io/docs/go-sdk): Go SDK reference and examples
- [Infrastructure as Code Examples](https://docs.limacharlie.io/docs/infrastructure-as-code): Configuration templates and examples

### Guides and Learning Resources
- [SecOps Cloud Platform Guide for Product Builders](https://limacharlie.io/secops-cloud-platform-guide-product-builders)
- [Getting Started Guide](https://docs.limacharlie.io/docs/getting-started): Quick start for new users
- [Detection & Response Rules Guide](https://docs.limacharlie.io/docs/detection-and-response): Writing custom D&R rules
- [Multi-Tenancy Guide](https://docs.limacharlie.io/docs/multi-tenancy): Managing multiple organizations
- [GitOps and Infrastructure as Code](https://docs.limacharlie.io/docs/gitops): Version-controlled configuration management
- [Observability Pipeline Guide](https://docs.limacharlie.io/docs/observability-pipeline): Data routing and transformation
- [Extension Development](https://docs.limacharlie.io/docs/extensions): Building custom integrations
- [YARA Scanning](https://docs.limacharlie.io/docs/yara): Continuous and on-demand scanning
- [BinLib Usage](https://docs.limacharlie.io/docs/binlib): Executable tracking and analysis
- [Support Bot (Chuck)](https://doc.limacharlie.io/): AI-powered documentation assistant

### Feature-Specific Pages
- [EDR Capabilities](https://limacharlie.io/edr): Cross-platform endpoint detection and response
- [Observability Pipeline](https://limacharlie.io/observability-pipeline): Data ingestion, transformation, and routing
- [Detection Engineering](https://limacharlie.io/detection-engineering): Custom rule creation and automation
- [Threat Hunting](https://limacharlie.io/threat-hunting): Retroactive hunting with one-year retention
- [Incident Response](https://limacharlie.io/incident-response): Rapid deployment and forensics capabilities
- [SIEM Cost Reduction](https://limacharlie.io/siem-alternative): Replace expensive data lakes
- [Multi-Cloud Security](https://limacharlie.io/multi-cloud): AWS, Azure, GCP integration

### Videos and Webinars
- [YouTube Channel](https://www.youtube.com/c/limacharlie): Official LimaCharlie channel
- [Navigating the SecOps Cloud Platform for Builders](https://www.youtube.com/watch?v=zq7Gw_lRrV4)
- [Extending the Platform](https://www.youtube.com/watch?v=RU7k3rtzBdQ)
- [Webinars Page](https://limacharlie.io/webinars): Upcoming and recorded webinars
- How LimaCharlie Transforms MSSPs: Webinar series on platform capabilities
- Workshops: EDR, Okta Integration, Defender EPP, Playbooks, and MSSP operations

### Case Studies and Customer Stories
- [Recon Infosec DFIR Case Study](https://info.limacharlie.io/hubfs/Case%20Studies/Recon-Infosec-DFIR-Case-Study-2023.pdf): MDR firm improves DFIR capabilities (PDF)
- **Lab 539**: Securing critical infrastructure (fuel depots and terminals) with OT security approach
- **Soteria**: MDR firm saves $100K per year with scalable automation and multi-tenant architecture
- **BLOKWORX**: Prevention-first security approach powered by native multi-tenancy
- **Financial Services**: 90% cost reduction in security testing across 49 financial institutions

### Blog Articles
- [Automating DFIR Workflows](https://limacharlie.io/blog/automating-incident-response-workflows)


## Community and Support

### Community Resources
- [Community Forum](https://community.limacharlie.io/): Public community for discussions and support
- [Support Channel](https://community.limacharlie.io/): AI-assisted support with engineer follow-up
- [Free Community Edition](https://free.limacharlie.io/): Get started with free tier, no credit card required

### Partner Programs
- [MSSP Partner Program](https://limacharlie.io/mssp-partners): Joint marketing, customer referrals, dedicated advisors
- [Developer Grant Program](https://limacharlie.io/grant-program): $1,000 credits for building on the platform
- Extension Marketplace: Publish and monetize your extensions

### Getting Started
- Start building immediately with no sales calls required
- Free tier available for testing and development
- Transparent pricing calculator on website
- No minimum commitments or long-term contracts

## Code Repositories and Open Source

### GitHub
- [LimaCharlie GitHub Organization](https://github.com/refractionPOINT): Open source projects and integrations
- [MCP Server](https://github.com/refractionPOINT/lc-mcp-server): Open source Model Context Protocol server implementation
- [Python SDK](https://github.com/refractionPOINT/python-limacharlie): Official Python SDK
- [Go SDK](https://github.com/refractionPOINT/go-limacharlie): Official Go SDK
- Infrastructure as Code Examples: Configuration templates and deployment examples
- Community Integrations: Open source adapters and extensions

### Open Source Integrations
- Velociraptor: Digital forensics and incident response
- MISP: Threat intelligence platform integration
- Hayabusa: Windows event log analysis
- Plaso: Super timeline analysis
- Zeek: Network security monitoring
- Atomic Red Team: Adversary emulation
- Sigma: Generic signature format for SIEM systems
- YARA: Pattern matching for malware research

## Platform Status and Compliance

### Platform Information
- [System Status](https://status.limacharlie.io/): Real-time platform status and uptime
- [Security](https://limacharlie.io/security): Security practices and compliance information
- [Trust Center](https://limacharlie.io/trust): Compliance certifications and audit reports
- [Privacy Policy](https://limacharlie.io/privacy): Data protection and privacy practices
- [Terms of Service](https://limacharlie.io/terms): Platform terms and conditions

### Compliance and Certifications
- SOC 2 Type II (if applicable)
- GDPR compliance
- Data residency options
- Industry-specific compliance support

## Social Media and Community

### Connect with LimaCharlie
- [LinkedIn](https://www.linkedin.com/company/limacharlie/): Company updates and insights
- [Twitter/X](https://twitter.com/limacharlieio): Platform updates and security news
- [YouTube](https://www.youtube.com/c/limacharlie): Video tutorials and webinars
- [GitHub](https://github.com/refractionPOINT): Open source projects

### Events and Conferences
- Black Hat: Annual security conference presence
- RSA Conference: Enterprise security showcase
- MSSP Alert Live: Service provider events
- Blue Team Con: Defensive security focus
- SecTor: Canadian security conference
- Various workshops and local meetups worldwide

## Platform Specifications

### Supported Platforms
- **Endpoint**: Windows, macOS, Linux, Chrome
- **Cloud**: AWS, Azure, GCP, and all major cloud providers
- **SaaS**: Office 365, Okta, GitHub, 1Password, and more
- **Network**: Zeek integration for network telemetry

### Performance Specifications
- **Response Time**: ~100 millisecond round-trip from cloud to endpoint
- **CPU Usage**: ~1% average per endpoint
- **Memory Usage**: ~50MB RAM per agent
- **Data Transfer**: ~1MB per day per endpoint (configurable)
- **Detection Processing**: Wire speed (real-time as data arrives)
- **Scale**: Supports thousands of tenants and millions of endpoints

### Data and Retention
- **Default Retention**: One year for all telemetry at no additional cost
- **Data Format**: All telemetry normalized to open JSON format
- **Storage Architecture**: Schema-less design, no pre-mapping required
- **Query Performance**: Full-text search across all retained data
- **Artifact Storage**: Binary files (logs, PCAPs, etc.) with automatic parsing

### API and Integration
- RESTful APIs for all platform capabilities
- Python and Go SDKs available
- Webhook and WebSocket support
- Model Context Protocol (MCP) server for AI agent integration
- GraphQL support for complex queries

### Data Formats
- All data normalized to open JSON format
- Support for CEF, Syslog, and unstructured text
- Automatic parsing of common file formats (EVTX, PCAP, etc.)
- Schema-less design requires no pre-mapping

### Output Destinations
- S3, SQS, Google Cloud Pub/Sub, BigQuery
- Kafka, SFTP, Webhooks, WebSockets
- Direct integration with major SIEM platforms
- Tailored streams for surgical data routing

### Security and Compliance
- **Encryption**: TLS 1.3 for all communications, at-rest encryption for stored data
- **Authentication**: Multi-factor authentication, SSO support, API key management
- **Access Control**: Role-based access control (RBAC), fine-grained permissions
- **Audit Logging**: Complete audit trail of all platform actions
- **Compliance**: SOC 2, GDPR, data residency options

### Platform Limits and Quotas
- **Detection Rules**: No limit on number of rules per organization
- **Outputs**: Unlimited outputs per organization
- **API Rate Limits**: Generous limits for programmatic access (documented in API reference)
- **Concurrent Connections**: No hard limit on connected sensors
- **Tenant Management**: No limit on number of managed tenants
- **Extension Subscriptions**: Subscribe to unlimited marketplace extensions

## Company Information

### Philosophy
LimaCharlie believes cybersecurity needs a neutral infrastructure provider similar to how AWS, Azure, and GCP serve IT operations. The platform is designed to give security engineers the tools they need to build appropriate solutions without vendor opinions dictating their approach. Every capability is designed for scale, supporting MDR and MSSP operations with thousands of customers.

### Core Values
- **Engineering-first**: Built by security engineers, for security engineers
- **Transparency**: No hidden costs, forced updates, or vendor lock-in mechanisms
- **Neutrality**: Infrastructure provider, not a competing service
- **Openness**: Public APIs, open documentation, open pricing
- **Customer control**: Users maintain complete control over their security operations

### Customer Testimonials
"LimaCharlie enables security engineers to gain control over their posture: full visibility, the ability to build workflows, and integrate with CI/CD pipelines. The stuff companies had to build in-house from scratch are provided on-demand, like Lego blocks." — Jonathon Haas

"If I was to build a new cyber security company, I'd build it on top of this." — Philip Martin

"We truly feel like LimaCharlie is an extension of our own team. The tech is great, but the relationship is easily the best part." — Glenn Starkman, CEO, Soteria

"What differentiates LimaCharlie from everyone else is the price structure, the ability to build our own tools on top of it and their amazing humans that are always there for questions you might have!" — Yochai Greenberg

### Contact and Demos
- [Request a Demo](https://limacharlie.io/demo-request): Speak with solutions engineers
- [Contact Sales](https://limacharlie.io/contact): Learn about pricing and capabilities
- [Start Free](https://limacharlie.io/signup): Begin with free community edition
- [Schedule Workshop](https://limacharlie.io/workshops): Hands-on platform training sessions
- [Support](https://community.limacharlie.io/): Community forum and support tickets

### Interactive Tools
- [Interactive Demo](https://limacharlie.io/demo): Storylane guided product tour
- [Pricing Calculator](https://limacharlie.io/pricing): Estimate costs based on usage
- [ROI Calculator](https://limacharlie.io/roi): Calculate potential savings vs current solutions
- [Platform Comparison](https://limacharlie.io/compare): Compare features with traditional solutions

## Additional Information

### Recognition
- Featured in Gartner Innovation Insight for Security Platforms 2024
- MSSP Alert Pricing Benchmark Report 2024 participant
- Growing ecosystem of partners and integrations

### Platform Updates
- Continuous platform updates with new capabilities
- No forced updates — users control when to adopt new features
- Regular community webinars and product announcements
- Active development of AI and automation capabilities

### Upcoming Features and Roadmap
- **Enhanced AI/MCP**: Expanded AI agent integrations and capabilities
- **Extended Platform APIs**: Additional programmatic access points

### Focus Areas for 2026
- AI-assisted security operations and automation
- Platform UI/UX enhancements

### Open Source Contributions
- Open source adapter for LimaCharlie platform
- Open source MCP server implementation
- Integration with popular open source security tools
- Community-driven development and feature requests

## Key Terminology and Concepts

### Platform Concepts
- **SecOps Cloud Platform (SCP)**: LimaCharlie's core offering - a public cloud infrastructure for security operations
- **Tenant/Organization**: A single customer environment within the platform
- **Multi-tenancy**: Native support for managing multiple customer environments from a single interface
- **Sleeper Mode**: Pre-deployed agents in low-cost standby mode that can be instantly activated
- **Wire Speed**: Processing telemetry and detections in real-time as data arrives

### Detection and Response
- **D&R Rules**: Detection and Response rules written in YAML that define both detection logic and automated response actions
- **LCQL**: LimaCharlie Query Language for searching and analyzing telemetry
- **Replay**: Capability to run detection rules retroactively against historical data
- **Tailored Streams**: Selective data outputs that only receive events matched by specific D&R rules
- **FIM**: File Integrity Monitoring for tracking file and registry modifications

### Data Management
- **Telemetry**: Structured event data from endpoints, cloud platforms, and other sources
- **Artifacts**: Binary files (logs, PCAPs, memory dumps) collected during investigations
- **BinLib**: Binary library that automatically tracks and indexes all executables seen in an environment
- **Outputs**: Destinations where telemetry and detections are forwarded (SIEM, webhooks, cloud storage)
- **Transforms**: Data modification operations that reshape events before forwarding

### Infrastructure and Automation
- **Infrastructure as Code (IaC)**: Managing platform configuration through code files instead of GUI
- **GitOps**: Version-controlled configuration management using Git repositories
- **GitSync**: LimaCharlie extension that automatically syncs configurations from Git repos
- **Extensions**: Custom integrations that extend platform functionality
- **Add-ons**: Pre-built capabilities available in the marketplace (Velociraptor, BinLib, Strelka, etc.)

### Integration Concepts
- **Bi-directionality**: Ability to send automated responses directly to telemetry sources (e.g., suspend O365 account)
- **EDR Passthrough**: Ingesting data from third-party EDR solutions (CrowdStrike, SentinelOne, etc.)
- **Adapter**: Software component that connects external systems to LimaCharlie
- **Webhook**: HTTP callback for real-time event notifications
- **MCP Server**: Model Context Protocol server for AI agent integration
~~~

## llms-full

Not found.