{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "LimaCharlie Release Notes",
  "description": "Releases and platform updates for LimaCharlie.",
  "home_page_url": "https://docs.limacharlie.io/10-release-notes/",
  "feed_url": "https://docs.limacharlie.io/10-release-notes/feed.json",
  "language": "en",
  "items": [
    {
      "id": "tag:docs.limacharlie.io,2026-08-14:release/endpoint-agent-5-3-6",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-536",
      "title": "Endpoint Agent 5.3.6",
      "content_html": "<h4 id=\"new-features\">New Features</h4>\n<ul>\n<li>Linux hosts that cannot provide a cgroup2 mount — unprivileged containers, read-only root filesystems, kernels built without cgroup BPF support — now keep kernel-level file, process, socket and network telemetry instead of losing all of it.</li>\n</ul>\n<h4 id=\"bug-fixes\">Bug Fixes</h4>\n<ul>\n<li>Fixed the sensor silently discarding queued events when its outbound queue filled up; discarded events are now counted and reported.</li>\n<li>The outbound event queue is now bounded by memory size as well as by event count, so a few very large events can no longer displace thousands of small ones.</li>\n<li>Fixed every kernel-sourced DNS event on Linux reporting process ID 0 and being held for 10 seconds before delivery.</li>\n<li>Fixed Linux network isolation being reported as available on hosts where the sensor could not exempt its own connection, where isolating the host would have cut off the connection needed to un-isolate it.</li>\n<li>Fixed the sensor aborting under Wine while collecting Windows Event Log events; an incomplete Event Log bookmark implementation is now detected at the point of use and log resumption is disabled cleanly.</li>\n<li>macOS file-access monitoring now matches file extensions case-insensitively, so a rule for <code>.docx</code> also matches <code>Report.DOCX</code>. Linux continues to match exactly.</li>\n<li>Removing an adhoc exfil rule now returns a receipt reporting whether the rule was found and removed, matching the behavior of adding one.</li>\n</ul>\n<h4 id=\"improvements\">Improvements</h4>\n<ul>\n<li><abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> diagnostics now report how many events the outbound queue has discarded, their estimated size, and the current queue depth against its limits.</li>\n<li><abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> diagnostics now report which Linux kernel telemetry subprograms are active, so a partial kernel acquisition is visible rather than appearing healthy.</li>\n<li>On Linux hosts without kernel DNS support, DNS collection now falls back to packet capture, and packet captures are opened only when that fallback is actually in use instead of on every Linux sensor.</li>\n<li>The sensor now warns when file-access monitoring is enabled with no file patterns configured, instead of appearing healthy while unable to report anything.</li>\n</ul>",
      "date_published": "2026-08-14T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-08-13:release/web-app-6-1-0",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-610",
      "title": "Web App 6.1.0",
      "content_html": "<p>Several UX improvements, new remediation signal (SLA due dates, root-cause roll-ups, coverage honesty), updated UX for some extensions, and performance improvements for Query Console.</p>\n<h4 id=\"new-features_1\">New Features</h4>\n<ul>\n<li><strong>Cloud Security speaks one language</strong>: every remaining screen — Inventory (Resources and Third-party assets), Attack Surface, Access, the Query Console, Compliance, Policies, Settings and the <abbr title=\"Managed Security Services Provider\">MSSP</abbr> fleet board — now opens on the shared tinted filter bar.</li>\n<li><strong>Compliance report layout</strong>: the Compliance screen becomes a charts-and-rail report — a compliance-score donut and a failures-by-severity bar chart side by side, the controls table beneath them, and the assignment cards as a rail running down beside all three.</li>\n<li><strong>Cloud Security fleet board modernized</strong>: <code>/cloud-security</code> adopts the UI language, adds two fleet rollup donuts, makes every column header a sort control, and splits freshness into sortable Last scan and Providers columns so a failing provider count is its own column rather than a badge in someone else's cell.</li>\n<li><strong>SLA due dates on the findings worklist</strong>: findings gain a Due column showing relative age (\"in 6d\", \"12d ago\", \"today\"), with a tooltip carrying the exact deadline, the SLA state, and the policy clause that set it.</li>\n<li><strong>Root-cause roll-ups on findings</strong>: when one finding's remediation already implies another, the child shows a \"root cause\" chip that links straight to its parent and the parent shows how many findings it implies.</li>\n<li><strong>Compliance score honesty</strong>: a framework that grades only a fraction of its controls no longer shows a bare green score. The score loses its good-result tint and states how much was actually assessed.</li>\n<li><strong>Vulnerability-source coverage</strong>: the Coverage tab adds a second dimension beside sensor coverage — whether anything is actually reporting CVEs on a workload — computed per scanner scope, so a workload with a sensor but no vulnerability source no longer reads as fully covered.</li>\n<li><strong>Real internet entry points in the kill chain</strong>: the first hop now renders the actual front door — App Service, Cloud Run URL, Kubernetes API server, function URL, load balancer, CDN, AI inference endpoint — labelled with its hostname, instead of a generic globe that said nothing about how an attacker got in.</li>\n<li><strong>Privilege escalation and cloud hierarchy in Topology</strong>: scope-escalation hops render as their own edge category with a distinct signature and priority on a crowded canvas, and cloud-hierarchy containers (organization, folder, project, account) draw as containers rather than workloads.</li>\n<li><strong><abbr title=\"Amazon Web Services\">AWS</abbr> boundary and trust evidence</strong>: permission boundaries, boundary-capped grants and trust-policy conditions on can-assume edges now have a screen, and a finding's cloud is read from the finding itself so vulnerability-coverage aggregates keep their cloud badge and readable resource name.</li>\n<li><strong>Dedicated <abbr title=\"In LimaCharlie, Exfil (Event Collection) is a configuration extension that determines which types of events are collected and sent from endpoint agents to the cloud. It controls the data flow, ensuring only specified events are transmitted for monitoring and analysis. To capture specific events,...\">Event Collection</abbr> page</strong>: <code>ext-exfil</code> replaces the generic schema-driven form with a first-class page.</li>\n<li><strong>Dedicated Artifact Collection page</strong>: <code>ext-artifact</code> gains a custom made UI page with Collection Rules and PCAP Capture Rules tabs.</li>\n<li><strong>Dedicated Reliable Tasking page</strong>: <code>ext-reliable-tasking</code> moves off the generic schema renderer onto a custom page.</li>\n<li><strong>The shared filter bar reaches the rest of the app</strong>: the Platform Logs audit tab, False Positive Rules, and the sensor Vulnerabilities tab all move onto the same panel. The sensor Vulnerabilities tab's four bordered summary tiles become stats on the bar, and the Payloads list moves onto the standard table so dates and sizes stop wrapping.</li>\n<li><strong>New Org and Recent Org lists for everyone</strong>: the redesigned organization and recent-organization lists are now the default for all users.</li>\n<li><strong>Query Console performance</strong>: a search over a large result set now completes much faster, holds less memory and spends less time in garbage collection. Scrolling with a row selected is more performant, and result sets that previously exhausted the browser's heap now load.</li>\n<li><strong>Connect wizard permissions</strong>: the provider setup flow's \"Permissions required\" list now includes the <abbr title=\"Amazon Web Services\">AWS</abbr> Organizations policy reads and the <abbr title=\"Google Cloud Platform\">GCP</abbr> Cloud Run / Cloud Functions viewer roles, so a customer following the least-privilege list verbatim gets the public-invoker exposure verdicts rather than silently missing them.</li>\n</ul>\n<h4 id=\"bug-fixes_1\">Bug Fixes</h4>\n<ul>\n<li>A single transient failure while polling for search results — a 502, a dropped connection, a laptop changing networks — permanently ended the search with no explanation; polling now survives it and picks the query back up.</li>\n<li>Returning to the Query Console tab after a network reconnect silently re-ran a finished search as a brand new server-side scan, replacing the results on screen and billing the org a second time.</li>\n<li>A crash affecting dropdown menus (\"Maximum update depth exceeded\") caused by an upstream <code>react-select</code> bug is fixed.</li>\n<li>The Cloud Security \"Failed\" sync badge showed the collector error only as hover text that could not be selected or copied; the tooltip now stays open and the badge copies the raw error to the clipboard.</li>\n<li>The Vulnerabilities tab and section no longer appear on a sensor's detail view for organizations not subscribed to vulnerability reporting, where they showed a misleading empty \"0 findings\" report.</li>\n<li>The CAASM coverage-policy editor offered a capability no source could satisfy, which produced a permanent coverage gap on every device; it is removed from the picker, and policies that already contain it render as unsupported instead of blank.</li>\n<li>SOPs and <abbr title=\"In LimaCharlie, an Organization represents a tenant within the Agentic SecOps Workspace, providing a self-contained environment to manage security data, configurations, and assets independently. Each Organization has its own sensors, detection rules, data sources, and outputs, offering complete...\">Organization</abbr> Notes had no working \"View Docs\" link, and their editors called records \"Sop\" and \"Org_notes\"; both now link to the published documentation and use proper record type names.</li>\n<li>The Inventory resource count rendered unformatted (<code>373109 assets</code>) while every other count on the screen used thousands separators, and a shared accessibility defect meant several dropdowns' labels were not associated with their control.</li>\n<li>The \"<abbr title=\"Endpoint Detection &amp; Response\">EDR</abbr> everywhere\" policy template button appeared to do nothing due to a read-after-write bug, and a full-screen empty state could swallow clicks on neighbouring controls.</li>\n</ul>",
      "date_published": "2026-08-13T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-08-11:release/endpoint-agent-5-3-5",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-535",
      "title": "Endpoint Agent 5.3.5",
      "content_html": "<h4 id=\"new-features_2\">New Features</h4>\n<ul>\n<li>Linux process events now identify the container a process belongs to, including its Kubernetes pod; the fields are absent for ordinary host processes.</li>\n<li>New Windows script visibility through the Antimalware Scan Interface: scripts and .NET assemblies are reported as the host application submits them for scanning, already deobfuscated. Enabled from the cloud.</li>\n<li>YARA memory detections now report the address of the match, so a detection points at the exact location in the target process.</li>\n<li>YARA rules can now use the <code>macho</code> module to inspect Mach-O images.</li>\n</ul>\n<h4 id=\"bug-fixes_2\">Bug Fixes</h4>\n<ul>\n<li>Fixed cloud-driven sensor upgrades never taking effect on macOS. The new binary is now put in place atomically before the service is stopped, on both macOS and Linux.</li>\n<li>Fixed the sensor sitting connected but idle for up to 10 minutes after its cloud connection was replaced, delaying collectors and telemetry; it now re-syncs immediately.</li>\n<li>Fixed the sensor hanging indefinitely when a configured proxy accepts the connection but never answers the CONNECT request; the attempt is now bounded and retried.</li>\n<li>Proxy replies split across packets, sent with LF-only headers, or answering with a 2xx status other than 200 are now handled correctly.</li>\n<li>Fixed the sensor's log file being created world-writable on installed Linux sensors.</li>\n<li>Uninstalling on Linux now removes the kernel acquisition mount point it used to leave behind, and macOS uninstall now deregisters its installer receipt.</li>\n<li>Fixed the arm64 Debian package being refused by dpkg; it is now published as <code>limacharlie_&lt;version&gt;_arm64.deb</code>.</li>\n<li>Payload downloads and artifact uploads are now strictly compliant HTTP, so filtering proxies and SSL inspection agents no longer drop them as malformed.</li>\n<li>Fixed artifact uploads reporting success while delivering no data when a network device answered with a redirect.</li>\n<li>Fixed certificate verification failures for payload downloads, artifact uploads and sensor upgrades on hosts with enterprise TLS inspection roots; verification now uses the operating system trust store alongside the built-in certificates.</li>\n<li>Fixed the sensor deadlocking while listing process handles when Windows stopped answering a handle name query.</li>\n<li>Fixed process hollowing detection rescanning every module in full instead of skipping the parts already matched on disk.</li>\n<li>Fixed stateful detection tracking comparing only part of its key, which could route events to the wrong tracking group.</li>\n<li>Fixed the sensor aborting under Wine when probing the Windows Event Log bookmark API.</li>\n<li>Fixed a potential out-of-bounds read when matching short YARA rule namespaces.</li>\n<li>Corrected swapped country and organization labels in the sensor's certificate issuer output.</li>\n</ul>\n<h4 id=\"improvements_1\">Improvements</h4>\n<ul>\n<li>Payload download and artifact upload failures now report a readable description in the command receipt and in the local log, instead of a bare numeric code.</li>\n<li>Transfer failures that previously all reported error 0 now report distinct codes: a sensor that has not yet received its artifact configuration, and a connection closed without a response.</li>\n<li>Payload downloads and artifact uploads now use a full HTTP client, adding chunked response support, correct response framing and enforced timeouts.</li>\n<li>The Linux x86_64 and i386 sensor now requires glibc 2.12 instead of 2.17, so it installs on older distributions; the optional eBPF module still requires 2.14.</li>\n<li>A configuration update is no longer held up by an in-progress payload download.</li>\n<li>The payload download size limit now applies to the whole transfer rather than to each resumed request.</li>\n</ul>",
      "date_published": "2026-08-11T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-07-29:release/web-app-6-0-2",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-602",
      "title": "Web App 6.0.2",
      "content_html": "<p>A rebuilt Cloud Security Risks triage table, finding ownership as a filter and column, a self-serve Cloud Security upgrade flow, and a reorganized sidebar.</p>\n<h4 id=\"new-features_3\">New Features</h4>\n<ul>\n<li><strong>Cloud Security Risks — dense triage worklist</strong>: the card-per-finding list is now a ruled, sortable table at roughly twice the row density, a sticky header, server-side sorting on Risk and Severity, and select-all in the header checkbox so the bulk triage bar only appears once you pick rows. Multiple UX improvements related to this change.</li>\n<li><strong>Owner facet and column on Risks</strong>: findings can now be filtered and scanned by who owns them. An Owner group in the facet rail lists Unassigned first, then your own account marked \"(you)\", then everyone else by count.</li>\n<li><strong>Data Security matches the Risks layout</strong>: the Data Security screen adopts the same tinted filter bar, flat facet rail and badge styling as the Risks worklist.</li>\n<li><strong>Self-serve Cloud Security upgrade</strong>: free-tier orgs can now upgrade without leaving the page. The trial band's CTA on the Cloud Security Overview opens an in-context upgrade modal that explains what upgrading changes, quotes the real monthly price for your org, collects payment details only if there's no card on file, and confirms on completion.</li>\n<li><strong>SOPs and <abbr title=\"In LimaCharlie, an Organization represents a tenant within the Agentic SecOps Workspace, providing a self-contained environment to manage security data, configurations, and assets independently. Each Organization has its own sensors, detection rules, data sources, and outputs, offering complete...\">Organization</abbr> Notes move to <abbr title=\"In LimaCharlie, an Organization represents a tenant within the Agentic SecOps Workspace, providing a self-contained environment to manage security data, configurations, and assets independently. Each Organization has its own sensors, detection rules, data sources, and outputs, offering complete...\">Organization</abbr> Settings</strong>: both sidebar entries move out of Automation — where they sat next to <abbr title=\"Detection &amp; Response\">D&amp;R</abbr> rules, playbooks and lookups — into the <abbr title=\"In LimaCharlie, an Organization represents a tenant within the Agentic SecOps Workspace, providing a self-contained environment to manage security data, configurations, and assets independently. Each Organization has its own sensors, detection rules, data sources, and outputs, offering complete...\">Organization</abbr> Settings group after Integrations, with matching breadcrumbs. Existing links and bookmarks to /sops and /org-notes still work.</li>\n<li><strong>Apps entry always visible in the sidebar</strong>: the Apps navigation item no longer disappears for users lacking the app.get permission; it renders for everyone and the page itself explains the missing permission when opened.</li>\n</ul>\n<h4 id=\"bug-fixes_3\">Bug Fixes</h4>\n<ul>\n<li>The \"Cloud Security isn't enabled\" screen sent its main button to the extension's configuration page, which has no way to subscribe and often showed a permission wall; it now goes to the marketplace entry where the extension can actually be subscribed, and the button reads \"View extension\".</li>\n<li>Cloud Security still described itself as pre-GA and not publicly subscribable in the not-enabled gate and the feedback modal, even though it is generally available and self-serve.</li>\n<li>The Risks lens picker showed an empty \"Select...\" whenever the active class filters didn't match a preset lens, making it look like no lens was applied while a filter was in fact active; it now reads \"Custom\".</li>\n<li>Cloud resources were classified by their name, so a load balancer called \"public-lb\" was drawn as the internet node and a VM called \"db-1\" was drawn as a data store; classification now uses the resource's actual type. Similarly, an IAM principal named something like \"public-reports@...\" was labelled \"Public - anyone on the internet\".</li>\n<li>The fleet board's top attack path card navigated to a retired URL and silently bounced users to the org Overview; it now opens the Attack Surface workspace, and old bookmarked path links redirect there too.</li>\n<li>Third-party assets and reconciled inventory assets both displayed as \"Third-party asset\" in the graph type filter and node labels; inventory assets now read \"Inventory asset\".</li>\n<li>The shared-fix strip and the \"resolves N findings\" count only considered one kind of root cause, so privilege-escalation causes never appeared and mixed causes were counted twice — the strip and the finding detail card could disagree on the same fix. The shared-fix card also described every cause as a firewall rule, even when the fix was an IAM role binding.</li>\n<li>Sortable Risk and Severity column headers rendered a truncated \"...\" because the label plus the sort icon didn't fit their track.</li>\n<li>In dark mode, Risks table rows swallowed their own dividers and the header band.</li>\n</ul>",
      "date_published": "2026-07-29T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-07-28:release/endpoint-agent-5-3-4",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-534",
      "title": "Endpoint Agent 5.3.4",
      "content_html": "<h4 id=\"new-features_4\">New Features</h4>\n<ul>\n<li>The registry listing command can now recursively list sub-keys down to an optional maximum depth, reporting fully-qualified key paths; oversized results are returned as partial replies flagged for follow-up.</li>\n</ul>\n<h4 id=\"bug-fixes_4\">Bug Fixes</h4>\n<ul>\n<li>Fixed corrupted process events from macOS kernel acquisition: invalid timestamps, missing file paths and command lines, and spurious phantom process records.</li>\n<li>Fixed file transfers and the sensor's cloud connection aborting when a TLS 1.3 server sends a post-handshake session ticket, common behind SSL-inspection proxies.</li>\n<li>Fixed repeated payload put commands failing on Windows: moving a file into place now overwrites an existing destination, matching other platforms.</li>\n<li>Fixed payload downloads and log/artifact uploads failing when certificate verification is explicitly disabled.</li>\n<li>Uninstalling the Windows MSI now fully removes the sensor's identity and data, so a later reinstall enrolls as a fresh sensor.</li>\n<li>Fixed a rare crash caused by concurrent use of the sensor's random number generator, seen most often on macOS under heavy file activity.</li>\n<li>Fixed a crash on sensor shutdown after a partially failed startup.</li>\n<li>Fixed a potential crash when reading executable paths from the Windows registry under low-memory conditions.</li>\n<li>Fixed assorted small latent bugs across the sensor uncovered by expanded static analysis.</li>\n</ul>\n<h4 id=\"improvements_2\">Improvements</h4>\n<ul>\n<li>Windows Event Log collection now resumes from where it left off after a sensor restart, recovering events logged while the sensor was not running.</li>\n<li><abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> upgrade and uninstall operations now write warnings and errors to a dedicated log file in the sensor data directory.</li>\n<li>Listing endpoint protection exclusions now reports an error code on failure, distinguishing a failed query from a host with no exclusions.</li>\n<li>Windows WMI query failures now report a dedicated WMI error code instead of a generic failure, for example when Defender is disabled by policy.</li>\n</ul>",
      "date_published": "2026-07-28T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-07-28:release/web-app-6-0-1",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-601",
      "title": "Web App 6.0.1",
      "content_html": "<p>A small fix to the Cloud Security onboarding sign-up flow.</p>\n<h4 id=\"bug-fixes_5\">Bug Fixes</h4>\n<ul>\n<li>Signing up from a Cloud Security onboarding link still asked which product you wanted before creating an account, even though the link had already committed you to one.</li>\n</ul>",
      "date_published": "2026-07-28T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-07-27:release/web-app-6-0-0",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-600",
      "title": "Web App 6.0.0",
      "content_html": "<p>Cloud Security goes generally available, a one-link self-serve onboarding flow, and a rebuilt Cloud Security Overview dashboard.</p>\n<h4 id=\"new-features_5\">New Features</h4>\n<ul>\n<li><strong>Cloud Security is generally available</strong>: the product is no longer gated behind an early-access flag, so every organization with the Cloud Security extension sees it in the sidebar.</li>\n<li><strong>Self-serve onboarding link</strong>: a single shareable URL - <code>/onboard?purpose=cloud-security</code> - now takes someone from no account to a working organization.</li>\n<li><strong>Cloud Security Overview rebuilt</strong>: the Overview now uses the same flat dashboard language as the Case Management dashboard.</li>\n<li><strong>Full-screen kill-chain view</strong>: the most-critical-path tile gains a \"View full screen\" action.</li>\n<li><strong>Trial status on the Overview</strong>: organizations on the Cloud Security trial now see a banner at the top of the Overview stating the provider-connection cap and how many are used, the trial length, and a \"See plans\" link — instead of only finding out when they hit the limit.</li>\n<li><strong>Provider-aware connect wizard diagram</strong>: the diagram in the provider setup wizard now draws what the provider you selected actually contributes — compute, network, data, identity, AI and vulnerability coverage for a cloud, or identities, apps and devices for a directory — and labels the credential path with how that provider authenticates (IAM roles, AssumeRole, GitHub App, and so on). The edge into your workspace now states the sync cadence you just chose on that step.</li>\n</ul>\n<h4 id=\"bug-fixes_6\">Bug Fixes</h4>\n<ul>\n<li>The Overview coverage bar read 100% in nearly every state, because it counted only sources that had already completed one sweep rather than the estate itself; it now reports accounts collecting, shows a real shortfall while a connected source has delivered nothing, and stays empty rather than showing 0/0 before the first scan lands.</li>\n<li>Privilege-escalation findings were drawn with an invented \"Internet -&gt; public exposure\" entry hop and a rationale claiming an open attack path, even for identity-only findings that are not internet-reachable; the exposure claim is now only made when the backend asserts it, and entitlement hops are labelled \"can assume\" instead of \"reaches\".</li>\n<li>The generic rationale on some findings printed a bare category name such as \"High ciem.\"; the three entitlement categories now spell out what they mean.</li>\n<li>Verifying your email during sign-up sent you to the organization list and lost the onboarding flow you started; the verification link now returns you exactly where you left off, and the original tab no longer sits on a stale \"verify your email\" card after verification completes.</li>\n<li>The choke-point sentence naming your crown-jewel resources appeared in English in every language; it is now translated across all locales.</li>\n<li>Creating a secret inline in the provider wizard labelled the name field \"New secret (required)\", which read as if it were the credential itself; it now says \"New secret name\". Providers that take a raw key (LimaCharlie, OpenAI, Anthropic) also show a bare-key placeholder instead of suggesting a JSON wrapper.</li>\n<li>The provider wizard and first-run artwork drew logos for internal resources on a provider LimaCharlie does not support; the illustrations no longer use them.</li>\n</ul>",
      "date_published": "2026-07-27T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-07-26:release/web-app-5-14-0",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-5140",
      "title": "Web App 5.14.0",
      "content_html": "<p>A redesigned permissions editor, modernized Outputs and Artifacts experiences, and an \"Overview\" org diagram.</p>\n<h4 id=\"new-features_6\">New Features</h4>\n<ul>\n<li><strong>Permissions — grouped, read/write-aware editor</strong>: the flat ~120-row permission lists become collapsible resource groups (collapsed by default, search auto-expands matches) with separate Read and Write bulk toggles per group.</li>\n<li><strong>Outputs — modernized list and dry-run testers</strong>: the Outputs list moves to the modern sortable table. New \"Test Transform\" / \"Test Template\" modals dry-run expressions server-side against an editable sample event before saving, and a WebSocket output destination is now creatable from the UI.</li>\n<li><strong>Artifacts — modernized list and full-screen viewer</strong>: the Artifacts list becomes a Detections-style table with a new full-screen record viewer.</li>\n<li><strong>Org Overview diagram</strong>: new \"Overview\" page with high level diagram.</li>\n<li><strong>Search — full-data exports</strong>: the query console download menu splits into \"Visible columns\" (CSV/Excel/HTML/PDF, mirroring the table) and \"All fields\" (NDJSON plus new CSV/Excel that export every flattened field of every event), so nested event details are no longer dropped from spreadsheet exports.</li>\n<li><strong>Sign-up — Grid escape hatch</strong>: the sign-up flow asks whether users want the full LimaCharlie platform or the AI-assisted Grid before choosing an auth method.</li>\n<li><strong>Entra ID adapter</strong>: an optional <code>streams</code> parameter (risk detections / sign-ins / audit logs) is exposed in the cloud adapter form and <abbr title=\"Command-line Interface\">CLI</abbr> template, and USP sensor tiles gain per-type documentation links (starting with Entra ID / Azure AD / Office 365).</li>\n<li><strong>Extended localization</strong>: extension pages for 10+ more extensions are now fully localized across all nine languages.</li>\n</ul>\n<h4 id=\"bug-fixes_7\">Bug Fixes</h4>\n<ul>\n<li>Permission checkboxes in the API-key, add-on, and extension editors updated the form value but never visually toggled after the grouped-editor rewrite; they now toggle correctly.</li>\n<li>Privileged permissions (<code>apikey.ctrl</code>, <code>user.ctrl</code>, <code>billing.ctrl</code>) could be bulk-granted in one click via select-all in the API-key/extension/add-on editors; they must now be granted individually.</li>\n<li>A hidden HoverCard added a second window scrollbar on every page that used one, sliding the app under the sidebar when scrolled.</li>\n<li>The modal close button floated over scrolled content in tall modals (e.g. the Data Classification rule editor); it now pins to the content and scrolls with the header.</li>\n<li>The sidebar collapse caret was hidden and unclickable on tablet-width viewports because the fixed top navbar overran the sidebar rail.</li>\n<li>Sortable table column headers wrapped their sort icon onto a second line in narrow columns (e.g. the Sensors \"Type\" column).</li>\n<li>Long unbroken tokens (resource ids, base64 keys) overflowed the CAASM \"What Changed\" column.</li>\n<li>Opening a Data Classification rule authored via <abbr title=\"Infrastructure as Code (IaC) automates the management and provisioning of IT infrastructure using code, making it easier to scale, maintain, and deploy resources consistently. In LimaCharlie, IaC allows security teams to deploy and manage sensors, rules, and other security infrastructure...\">IaC</abbr> could crash the item detail when a hand-authored rule carried non-string values; such values are now coerced safely.</li>\n<li>The Artifacts list sent Insight timestamps in milliseconds instead of seconds, breaking the feature once the API began rejecting out-of-range values.</li>\n</ul>",
      "date_published": "2026-07-26T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-07-15:release/web-app-5-13-0",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-5130",
      "title": "Web App 5.13.0",
      "content_html": "<p>Expanded Vulnerability Reporting, a revamped audit log, a redesigned REST API section, and continued localization across the extension catalog.</p>\n<h4 id=\"new-features_7\">New Features</h4>\n<ul>\n<li><strong>Vulnerability Reporting</strong>: a new Vulnerable Packages tab (with a package drawer listing live affected hosts) and a \"Group by application\" toggle on per-host tables that collapses per-CVE rows to one line per application. Exports are stamped with org name and <abbr title=\"In LimaCharlie, an Organization ID (OID) is a unique identifier assigned to each tenant or customer account. It distinguishes different organizations within the platform, enabling LimaCharlie to manage resources, permissions, and data segregation securely. The Organization ID ensures that all...\">OID</abbr>, gain a server-generated remediation-plan CSV and a vulnerable-packages CSV.</li>\n<li><strong>Vulnerabilities dashboard polish</strong>: the Packages table collapses like the other tabs, posture stats match the detail-panel strip, and the CVE and package detail sidebars cross-link to each other. The CISA KEV catalog now opens with the full filter parameters applied.</li>\n<li><strong>Audit log revamp</strong>: the Platform Logs audit tab adds sensor, date-range, and event-type filters plus client-side origin/identity search, bidirectional infinite scroll (\"Load newer events\"), and a row detail panel with a scrollable JSON viewer of the raw record.</li>\n<li><strong>REST API section redesign</strong>: API Details becomes a compact definition card with hover-to-copy on API Root, <abbr title=\"In LimaCharlie, an Organization ID (OID) is a unique identifier assigned to each tenant or customer account. It distinguishes different organizations within the platform, enabling LimaCharlie to manage resources, permissions, and data segregation securely. The Organization ID ensures that all...\">OID</abbr>, and Org JWT and a Swagger reference link. The User-Generated, Service-Managed, and Ingestion key tables move behind a segmented pill switcher showing one table at a time, with a contextual Create button and one-line dates.</li>\n<li><strong>EPP status dashboard</strong>: the per-sensor EPP status page is redesigned as a status dashboard, with the metric tiles filled out and macOS status, product name, and not-subscribed states corrected on the <abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> Overview EPP card.</li>\n<li><strong>AI provider onboarding</strong>: a <abbr title=\"Command-line Interface\">CLI</abbr> escape hatch lets you configure AI providers not yet supported in the guided onboarding flow.</li>\n<li><strong>Internationalization</strong>: continued localization of the extension catalog - Artifact, binlib, reliable-tasking, EPP, dumper, integrity, feedback, exfil, atomic-red-team, govee, hayabusa, infrastructure, lookup-manager, and ~30 more extension pages are now translated across all nine locales.</li>\n</ul>\n<h4 id=\"bug-fixes_8\">Bug Fixes</h4>\n<ul>\n<li>Tooltips now render above modals instead of behind them.</li>\n<li>Cloud adapter forms now enforce required secret and number fields before submit.</li>\n<li><abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> Overview hides cards and chips that don't apply to adapters and USP sensors, long tags no longer blow out the Overview grid, and EPP status resolves instead of stalling on \"Waiting for sync\".</li>\n<li>A newly created hive record shows its GUID immediately, and User ID click-to-copy is restored on the account settings page.</li>\n<li>Workload Scanning last-scan stats are corrected (wire tolerance) with a richer Last Scan detail, and the \"Findings closed\" column in Top remediations is fixed. The CVE sidebar count stat is labelled \"Findings\" rather than \"Impacted hosts\".</li>\n</ul>",
      "date_published": "2026-07-15T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-07-14:release/endpoint-agent-5-3-3",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-533",
      "title": "Endpoint Agent 5.3.3",
      "content_html": "<h4 id=\"new-features_8\">New Features</h4>\n<ul>\n<li>The sensor service can now be upgraded or uninstalled through cloud tasking.</li>\n<li>Upgrade and uninstall commands reply with their result, including the OS error code on failure.</li>\n<li><abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> upgrades can be pinned to a specific version.</li>\n<li><abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> connections now report a unique per-boot identifier to the cloud.</li>\n<li><abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> connections now report the main network interface's MAC address.</li>\n<li>Windows endpoint protection status now falls back to Security Center antivirus data when the Defender query fails.</li>\n</ul>\n<h4 id=\"bug-fixes_9\">Bug Fixes</h4>\n<ul>\n<li>Sensors that connect but receive no data from the cloud now retry with a fresh TLS handshake after 30 seconds.</li>\n<li>Fixed connection failures under pinned-certificate trust: TLS hostname verification now applies only to public CA trust.</li>\n<li>Fixed a TLS 1.2 handshake failure with servers using certain RSA-PSS signature schemes.</li>\n<li>Fixed macOS notarization of the sensor binary.</li>\n<li>Fixed a thread-synchronization race on Linux and macOS that could destabilize the sensor.</li>\n<li>Fixed a small memory leak when kernel acquisition shuts down on macOS.</li>\n<li>Fixed incorrect formatting in several sensor debug log messages.</li>\n<li>Fixed assorted small bugs across the sensor on Linux and Windows.</li>\n</ul>\n<h4 id=\"improvements_3\">Improvements</h4>\n<ul>\n<li>Updated the embedded TLS library (mbedtls) to 4.1.1.</li>\n</ul>",
      "date_published": "2026-07-14T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-07-09:release/web-app-5-12-0",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-5120",
      "title": "Web App 5.12.0",
      "content_html": "<p>The console and Grid app are now fully localized in English, Español, 日本語, Français, Deutsch, Português, 한국어, Italiano, and Nederlands alongside redesigned sensor pages and per-sensor vulnerability report exports.</p>\n<h4 id=\"new-features_9\">New Features</h4>\n<ul>\n<li><strong>Internationalization</strong>: the console and Grid app are fully localized in English, Spanish (Español), Japanese (日本語), French (Français), German (Deutsch), Portuguese (Português), Korean (한국어), Italian (Italiano), and Dutch (Nederlands). A Language Switcher in User Settings sets the preferred language per device.</li>\n<li><strong><abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> Analytics dashboard</strong>: the per-sensor Analytics page is rebuilt as a responsive card-grid dashboard with a single shared time-range selector, replacing the stack of full-width charts.</li>\n<li><strong><abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> Overview redesign</strong>: identity, network, and system details are organized into grouped cards with inline status chips for connection, seal, network, and platform state. Seal and Isolate controls move into the page header, with the full pending/cancel state machine preserved.</li>\n<li><strong>Search progress indicator</strong>: the query console status line shows a live percent-scanned figure while a paginated query runs, with a hover tooltip listing batch, event, and data counts for the in-scope scan. Cancelled searches are now labelled \"Cancelled\" instead of \"Complete!\".</li>\n<li><strong>Per-sensor Vulnerability Report export</strong>: the <abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> Vulnerabilities tab adds an Export report menu with PDF, HTML, Markdown, CSV, and Excel formats. Reports include a KPI summary strip, top remediation recommendations aggregated by package and fix version, and the full findings table (CVE, application, version, severity, score, LC Risk, EPSS %, KEV, fix version, first detected date).</li>\n<li><strong>Builder Program promo</strong>: free-tier users periodically see a Builder Program offer (first 3 months free) in the console. The promo is limited to first-party LimaCharlie branding, shown at most once every 7 days, and suppressed permanently once a user expresses interest.</li>\n<li><strong>Vulnerability tables: First Detected and Version columns</strong>: both the sensor-level and org-level vulnerability tables add a sortable First Detected column (the date a vulnerability was first observed on the host, marking the start of the remediation clock) and a Version column showing the installed version of each vulnerable package. The version value also feeds the compliance CSV export, replacing a previously hardcoded blank.</li>\n<li><strong>Vulnerabilities dashboard and CVE detail redesign</strong>: the org Vulnerabilities page replaces the 2×4 KPI card grid with a compact posture strip, brings charts forward, and narrows the CVE list/detail gracefully on smaller viewports. The CVE detail gains a cleaner CVSS metric card and a full-width EPSS percentile meter with banded severity coloring.</li>\n<li><strong>Microsoft Defender adapter</strong>: an optional Endpoint field targets Enterprise (Commercial), GCC, GCC High (L4), or DoD (L5) Microsoft cloud environments. Existing adapters continue to use the enterprise endpoint by default.</li>\n<li><strong>SentinelOne adapter</strong>: optional <code>site_ids</code> and <code>account_ids</code> fields scope ingestion to a single tenant of an MSP/partner console, and a <code>collect_agents</code> toggle pulls all in-scope endpoints as individual sensors immediately rather than waiting for telemetry.</li>\n<li><strong><abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> sub-page tables</strong>: Autoruns, Drivers, <abbr title=\"In LimaCharlie, Exfil (Event Collection) is a configuration extension that determines which types of events are collected and sent from endpoint agents to the cloud. It controls the data flow, ensuring only specified events are transmitted for monitoring and analysis. To capture specific events,...\">Event Collection</abbr>, Packages, Users, Services, Integrity, and Processes migrate to the updated table component, gaining sortable column headers, truncation tooltips, and consistent viewport-fill height. <abbr title=\"In LimaCharlie, Exfil (Event Collection) is a configuration extension that determines which types of events are collected and sent from endpoint agents to the cloud. It controls the data flow, ensuring only specified events are transmitted for monitoring and analysis. To capture specific events,...\">Event Collection</abbr> and Integrity rule chips move into per-row kebab menus, and several empty-state typos are fixed.</li>\n<li><strong>Analytics charts</strong>: all analytics charts across <abbr title=\"Detection &amp; Response\">D&amp;R</abbr> rules, False-Positive rules, Outputs, <abbr title=\"Adapters serve as flexible data ingestion mechanisms for both on-premise and cloud environments.\">Adapter</abbr> Analytics, VibeRails, Billing quota, and the Grid app are updated. Outputs and <abbr title=\"Adapters serve as flexible data ingestion mechanisms for both on-premise and cloud environments.\">Adapter</abbr> Analytics charts now display side by side with a single shared time-range selector.</li>\n</ul>\n<h4 id=\"bug-fixes_10\">Bug Fixes</h4>\n<ul>\n<li>The \"Create new App\" button now works for orgs with zero apps; a transparent overlay was intercepting pointer events over the page header.</li>\n<li>Opening the AI Terminal no longer crashes the app with \"Maximum update depth exceeded\".</li>\n<li>Seal and isolate pending transition states now display correctly, so \"Pending rejoin\" and \"Pending unseal\" surface during the backend transition window instead of holding on \"Isolated\" or \"Sealed\".</li>\n</ul>",
      "date_published": "2026-07-09T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-07-06:release/endpoint-agent-5-3-2",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-532",
      "title": "Endpoint Agent 5.3.2",
      "content_html": "<h4 id=\"bug-fixes_11\">Bug Fixes</h4>\n<ul>\n<li>Fixed connection failures under pinned-certificate trust: TLS hostname verification now applies only to public CA trust.</li>\n<li>Fixed a TLS 1.2 handshake failure with servers using certain RSA-PSS signature schemes.</li>\n</ul>",
      "date_published": "2026-07-06T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-07-02:release/endpoint-agent-5-3-1",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-531",
      "title": "Endpoint Agent 5.3.1",
      "content_html": "<h4 id=\"new-features_10\">New Features</h4>\n<ul>\n<li>TLS 1.3 is now supported for the sensor's connection to the LimaCharlie cloud, with automatic fallback to TLS 1.2.</li>\n<li>Shell commands can now be run as a specific user instead of always running with the sensor's own privileges.</li>\n<li>USB Data Loss Prevention is now configuration-driven, so the enforcement mode and allowed-device list persist across restarts and can be managed centrally from the cloud.</li>\n</ul>\n<h4 id=\"bug-fixes_12\">Bug Fixes</h4>\n<ul>\n<li>Improved the reliability of running shell commands: fixed lost error output, incorrect exit codes, and commands being cut short on hosts whose clock jumps.</li>\n<li>Endpoint protection status now reports specific errors when a query fails, instead of a single generic failure.</li>\n<li>Fixed several memory-safety issues and memory leaks across the sensor, including at shutdown and on Windows.</li>\n</ul>\n<h4 id=\"improvements_4\">Improvements</h4>\n<ul>\n<li>Linux kernel component failures are now easier to diagnose, with more detail reported in its status.</li>\n</ul>",
      "date_published": "2026-07-02T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-06-29:release/web-app-5-11-0",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-5110",
      "title": "Web App 5.11.0",
      "content_html": "<p>Expanded AI cost tracking adds spend breakdowns, <abbr title=\"Managed Security Services Provider\">MSSP</abbr> chargeback, and a savings trend to the AI Usage page, now available in the main web app alongside deeper Vulnerabilities filtering and functional app egress.</p>\n<h4 id=\"new-features_11\">New Features</h4>\n<ul>\n<li><strong>AI cost tracking</strong>: the AI Usage page now offers 7/30/90-day ranges, a KPI strip (spend, investigations, cost per investigation, tokens), spend breakdowns by model and detection rule with per-investigation unit cost, per-tenant re-bill markup for <abbr title=\"Managed Security Services Provider\">MSSP</abbr> chargeback in the CSV export, anomaly and trend indicators, and a savings trend chart. Sub-cent costs display adaptive precision instead of rounding to $0.00.</li>\n<li><strong>AI Usage in the main web app</strong>: the AI Usage view, previously Grid-only, is now reachable from the main web app sidebar under the AI group, gated by the <code>ai_agent.get</code> permission.</li>\n<li><strong>Vulnerabilities subscription gating</strong>: orgs without the Vulnerability Reporting extension now see a subscribe call-to-action (for <code>billing.ctrl</code> users) or an admin-contact prompt, replacing the misleading empty state.</li>\n<li><strong>Vulnerabilities platform filtering</strong>: the Platform facet now scopes the CVEs tab, and dashboard charts and KPI tiles update to reflect active Severity and Platform filters, with a caveat label when other filters can't be represented in the rollup.</li>\n<li><strong>Vulnerabilities application grouping</strong>: the host vuln table splits the combined column into sortable Application and CVE columns, grouping all CVEs for a package together; the org drawer defaults to application sort and the sensor tab keeps score sort.</li>\n<li><strong>Vulnerabilities false-positive feedback</strong>: a per-finding \"Report incorrect detection\" action collects a structured reason and relays it to the product team, separate from the local mark-false-positive triage action.</li>\n<li><strong>Gmail adapter</strong>: setup and edit forms for single-mailbox OAuth and Workspace service-account flows, with per-feed capability toggles, subject scoping, and masked managed-secret storage for service-account credentials.</li>\n<li><strong>ThreatLocker adapter</strong>: Include Child Organizations scoping for parent API tokens and individual toggles for the Approval Requests, Unified Audit, and System Audit feeds.</li>\n<li><strong>Brand feature flags</strong>: branded deployments can disable fleet billing, case management, automation SOPs, mini apps, and the AI terminal per deployment.</li>\n<li><strong>Windows PowerShell installer</strong>: the Windows install wizard leads with a copy-paste PowerShell one-liner using LimaCharlie's hosted install.ps1, mirroring the Linux curl installer, with the manual EXE/MSI tab still available.</li>\n<li><strong>Search timing breakdown</strong>: the per-stage timing breakdown is now on by default for all users.</li>\n<li><strong><abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> Connectivity</strong>: the Add <abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> panel now lists the org's webhook endpoint alongside the existing addresses, making firewall setup for cloud sensors and webhook adapters easier.</li>\n<li><strong>Apps launcher icons</strong>: apps now derive distinct icons from author emoji, required-permission prefixes, and other signals before falling back to the generic diamond.</li>\n<li><strong>Per-theme logos</strong>: runtime configs support a dedicated dark-theme logo alongside the standard logo.</li>\n</ul>\n<h4 id=\"bug-fixes_13\">Bug Fixes</h4>\n<ul>\n<li>Apps declaring allowed_origins can now make third-party fetch() calls; apps load from a real HTTP origin with their own permissive floor CSP instead of inheriting the console's strict policy. The brokered lc.api path and app isolation are unchanged.</li>\n<li>Apps now open correctly on Grid, which previously failed with a sandbox handshake timeout.</li>\n<li>Creating a false-positive rule from a detection now names the draft from the detection (category and detect ID) instead of \"Untitled-1\".</li>\n<li>Deleting a REST API key now requires confirmation through a danger dialog, preventing accidental deletion that would break integrations.</li>\n<li>Replaying a <abbr title=\"Detection &amp; Response\">D&amp;R</abbr> rule with target: detection now runs against the detection stream instead of the event stream, which had matched nothing.</li>\n<li>Projection queries that select <code>ts</code> without an alias now show the column, formatted as YYYY-MM-DD HH<img alt=\"🇲🇲\" class=\"twemoji\" src=\"https://cdn.jsdelivr.net/gh/jdecked/twemoji@16.0.1/assets/svg/1f1f2-1f1f2.svg\" title=\":mm:\" />ss in the table and exports.</li>\n<li>Saved query text can now be edited in the Edit Query modal, not just renamed.</li>\n<li>The saved-query size limit now matches the backend's 1024-byte ceiling, raised from a stricter 512-byte client cap.</li>\n<li>CVE descriptions from the NVD feed now render as sanitized HTML instead of literal tag text on the CVE detail page and sidebar drawer.</li>\n<li>The CVE detail page layout is now stable, with stacked tables sized to their actual row count instead of growing unboundedly or leaving large empty gaps.</li>\n<li>The KEV and Total vulnerability tiles now use server-computed host-wide counts instead of page-limited values, fixing incorrect counts for sensors with many findings.</li>\n<li>The create-case org picker now shows all cases-enabled orgs for accounts spanning more than 200 orgs, resolving names for up to 10,000 orgs.</li>\n<li>Social share previews are fixed for Grid and the main web app, with OG and Twitter tags added and robots.txt updated to allow social crawlers while keeping the console out of search indexes.</li>\n</ul>",
      "date_published": "2026-06-29T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-06-18:release/web-app-5-10-0",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-5100",
      "title": "Web App 5.10.0",
      "content_html": "<p>Fleet Billing arrives for MSSPs, alongside AI Terminal refinements and clearer session-state reporting.</p>\n<h4 id=\"new-features_12\">New Features</h4>\n<ul>\n<li><strong>Fleet Billing</strong>: a cross-tenant billing console for MSSPs.</li>\n<li><strong>AI Terminal</strong>: visual improvements and refined landing actions.</li>\n<li><strong>AI session statuses</strong>: Running, Waiting, and Ended states, with an indicator when a session is awaiting user input.</li>\n<li><strong>Access Management</strong>: added a Role column to the user table.</li>\n<li><strong>Case console</strong>: added a selectable page size.</li>\n</ul>\n<h4 id=\"bug-fixes_14\">Bug Fixes</h4>\n<ul>\n<li>Query console download now matches the visible table.</li>\n<li>Added a Minimize button to the AI Session chat floating button.</li>\n<li>Added the AI Session chat button to the sessions page.</li>\n<li>Restored the \"Download file from session\" action in the chat menu.</li>\n<li>Restored the app version and release notes in the profile menu, and fixed the Dark Mode font.</li>\n<li>Adjusted the light-mode AI Terminal card fill color for better contrast.</li>\n</ul>",
      "date_published": "2026-06-18T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-06-11:release/web-app-5-9-0",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-590",
      "title": "Web App 5.9.0",
      "content_html": "<p>Notable improvements and fixes:</p>\n<h4 id=\"new-features_13\">New Features</h4>\n<ul>\n<li><strong>AI Terminal ShareCard</strong> — share sessions socially and invite users to tenants.</li>\n<li><strong>Docked corner chat</strong> — persistent AI chat launcher with pop-out, draft-new-session, minimize/maximize, and a live-session selector.</li>\n<li><strong>Session fork</strong> — fork an AI session with full lineage tracking.</li>\n<li><strong>Card-list session browser</strong> inside the chat layout with a unified action dropdown.</li>\n<li><strong>Onboarding demand-signal cards</strong> for unsupported AI providers.</li>\n<li><strong>Feedback rich card</strong> plus unsupported-request guidance for the AI FDE.</li>\n<li><strong>ThreatLocker</strong> platform and adapter support.</li>\n<li><strong>AI Workbench</strong> — agent usage moved into a dedicated Usage tab.</li>\n<li><strong>Search</strong> — scroll-to-top/bottom buttons, perceived + server timing on the status line, and query ID in the timing breakdown tooltip.</li>\n<li><strong>AI Sessions</strong> — rationalized session user state (Active + needs-attention), and <code>lc-compliance</code> as a selectable plugin.</li>\n<li><strong>Git Sync</strong> — added missing config hives to the UI.</li>\n</ul>\n<h4 id=\"bug-fixes_15\">Bug Fixes</h4>\n<ul>\n<li>Fixed dark-mode LimaCharlie logo visibility.</li>\n<li>Included <code>ai_agent.operate</code> in FDE and worker-key permission lists.</li>\n<li>Cases — batched bulk assign / tags / close-note to avoid rate-limit failures.</li>\n<li>Restored the agent list table in the AI Agents tabs.</li>\n<li>CVE detail now opens from the sensor vulnerability list.</li>\n<li>Timestamp column hidden for aggregation search results.</li>\n</ul>",
      "date_published": "2026-06-11T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-06-05:release/endpoint-agent-5-3-0",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-530",
      "title": "Endpoint Agent 5.3.0",
      "content_html": "<h4 id=\"new-features_14\">New Features</h4>\n<ul>\n<li>New <code>reg_get</code> command fetches a single named Windows registry value by key and value name, for values too large or keys too crowded to retrieve with <code>reg_list</code>.</li>\n<li>macOS installation is now a single guided window with a three-step checklist — system extension, network content filter, Full Disk Access — replacing the previous sequence of seven separate prompts.</li>\n</ul>\n<h4 id=\"bug-fixes_16\">Bug Fixes</h4>\n<ul>\n<li>Fixed macOS file-creation events reporting the parent directory instead of the new file's path, which stopped exfil watch rules from matching specific files.</li>\n<li>Fixed a leak of registry key handles when listing Windows registry keys.</li>\n</ul>\n<h4 id=\"improvements_5\">Improvements</h4>\n<ul>\n<li>File hashing is faster and allocates far less memory, lowering sensor overhead on hosts with heavy file activity.</li>\n</ul>",
      "date_published": "2026-06-05T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-05-30:release/endpoint-agent-5-2-6",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-526",
      "title": "Endpoint Agent 5.2.6",
      "content_html": "<h4 id=\"bug-fixes_17\">Bug Fixes</h4>\n<ul>\n<li>Fixed very large artifact uploads never completing: each part is now retried up to ten times with backoff, so a brief network interruption no longer restarts the transfer from the beginning.</li>\n<li>Fixed uploads of locked files larger than 4 GB on Windows looping indefinitely over the first 4 GB.</li>\n<li>The sensor now shuts down promptly while an upload is retrying, instead of waiting out its backoff.</li>\n</ul>",
      "date_published": "2026-05-30T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-05-09:release/vulnerability-management-uplift",
      "url": "https://docs.limacharlie.io/10-release-notes/#vulnerability-management-uplift",
      "title": "Vulnerability Management Uplift",
      "content_html": "<p>Major uplift to the Vulnerability Reporting extension and its surfaces.</p>\n<ul>\n<li><strong>Canonical asset-tag namespace</strong>: introduces the <code>lc:asset:*</code> tag convention (criticality, exposure, environment, owner, compliance) for cross-cutting asset metadata. The Vulnerability Reporting extension is the first consumer; the namespace is intended to be reused across LimaCharlie surfaces. See <a href=\"https://docs.limacharlie.io/2-sensors-deployment/asset-tags/\">Asset <abbr title=\"Tags in LimaCharlie are strings linked to sensors for classifying endpoints, automating detection and response, and triggering workflows. Tags appear in every event under the `routing` component and help simplify rule writing. Tags can be added manually, via API, or through detection &amp; response...\">Tag</abbr> Namespace</a>.</li>\n<li><strong>Vulnerability Reporting extension</strong>: new public-facing documentation covering setup, scan modes (<code>scheduled</code> / <code>manual</code> / <code>all</code>), criticality-tag overrides, KEV + EPSS enrichment, LC Risk scoring, and the full action surface. See <a href=\"https://docs.limacharlie.io/5-integrations/extensions/limacharlie/vulnerability-reporting/\">Vulnerability Reporting</a>.</li>\n<li><strong>Finding resolutions</strong>: documented the resolution model — every finding is implicitly <strong>open</strong> until an operator records <code>mitigated</code>, <code>accepted</code>, or <code>false_positive</code>. Accepted-exception expiries lapse back into the open count, and <code>vuln_finding.*</code> events (<code>created</code>, <code>closed</code>, <code>kev_match</code>, <code>state_changed</code>) can be routed via Outputs to Jira, Slack, Cases, etc.</li>\n</ul>",
      "date_published": "2026-05-09T00:00:00+00:00",
      "tags": [
        "platform"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-04-02:release/endpoint-agent-5-1-0",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-510",
      "title": "Endpoint Agent 5.1.0",
      "content_html": "<h4 id=\"new-features_15\">New Features</h4>\n<ul>\n<li>The <code>os_drivers</code> command now works on Linux, listing the host's loaded kernel modules.</li>\n<li>The sensor health check now downloads and verifies the latest health-check binary from the cloud, so diagnostics stay current without upgrading the sensor.</li>\n</ul>\n<h4 id=\"bug-fixes_18\">Bug Fixes</h4>\n<ul>\n<li>Fixed macOS and Windows sensors staying on a dead connection for hours after a network disruption; keepalive behavior is now consistent across all platforms and connections recover promptly.</li>\n<li>Fixed occasional missing line breaks in the sensor's local log file.</li>\n</ul>\n<h4 id=\"improvements_6\">Improvements</h4>\n<ul>\n<li>The sensor health check now reports details of the installed sensor binary on disk.</li>\n<li><abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> debug data now includes the sensor service version.</li>\n<li><abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> service details are now reported to the cloud on every sync, instead of only when debug data is requested.</li>\n<li>Linux and macOS sensor binaries are smaller.</li>\n</ul>",
      "date_published": "2026-04-02T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-02-08:release/endpoint-agent-4-33-26",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-43326",
      "title": "Endpoint Agent 4.33.26",
      "content_html": "<ul>\n<li><strong>Feature</strong>: Windows ARM64 support</li>\n<li>Fix cloud initialization issue on start and reboots</li>\n<li>Fix an eBPF umount issue on Linux whenever LVM is used</li>\n</ul>",
      "date_published": "2026-02-08T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2026-02-08:release/web-app-5-5-5",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-555",
      "title": "Web App 5.5.5",
      "content_html": "<p>Enhancements to the AI Sessions experience with granular permission controls and improved session management, adds Windows ARM64 sensor support for customers on newer Windows hardware, introduces search customization features including drag-and-drop column reordering and improved time range displays, and streamlines the sensor installation workflow with better Docker instructions and installation key visibility. The release also includes important security improvements for OAuth authentication and API key isolation between environments.</p>\n<ul>\n<li><strong>AI Sessions</strong>: Granular permissions, pagination, SOPs enabled</li>\n<li><strong>Windows ARM64</strong>: New sensor support for ARM-based Windows devices</li>\n<li><strong>Search</strong>: Drag-and-drop columns, column popover, improved time display</li>\n<li><strong>Investigation Viewer</strong>: Major overhaul with new sidebar and unified data handling</li>\n<li><strong><abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> Installation</strong>: Better Docker instructions, fixed modal behavior</li>\n<li><strong>Security</strong>: Environment-specific API keys, GitHub OAuth trust, CSP fixes</li>\n</ul>",
      "date_published": "2026-02-08T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-10-24:release/endpoint-agent",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent",
      "title": "Endpoint Agent",
      "content_html": "<h4 id=\"stable-433105\">Stable: 4.33.10.5</h4>\n<ul>\n<li>Fix an issue with the <code>epp_list_exclusions</code> command not showing all exclusions</li>\n</ul>\n<h4 id=\"latest-43319\">Latest: 4.33.19</h4>\n<ul>\n<li>Fix an issue with the <code>epp_list_exclusions</code> command not showing all exclusions</li>\n<li>Change the compression algorithm for Debian installer packages from xz to gzip for better compatibility with older distributions</li>\n</ul>",
      "date_published": "2025-10-24T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-10-24:release/web-app-5-2-1",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-521",
      "title": "Web App 5.2.1",
      "content_html": "<p>A good batch of bug fixes.</p>",
      "date_published": "2025-10-24T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-10-17:release/endpoint-agent",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent_1",
      "title": "Endpoint Agent",
      "content_html": "<p><strong>New stable release 4.33.10.4</strong> - fixed memory leak in file type tracker, upgrade recommended.</p>\n<p><strong>New release 4.33.18:</strong></p>\n<p>Number of fixes including:</p>\n<ul>\n<li>A memory leak in the file type tracker</li>\n<li>Potential crashes in cloud task processing and log tracker</li>\n<li>Version reporting fixes on Windows 11, Linux, and macOS</li>\n<li>Certificate updates to avoid solely relying on the platform keychain</li>\n<li>Update the size of the file tracking buffer to avoid missing events on Linux</li>\n</ul>",
      "date_published": "2025-10-17T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-10-17:release/web-app-5-2-0",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-520",
      "title": "Web App 5.2.0",
      "content_html": "<p><strong>Features:</strong></p>\n<ul>\n<li>Show errors \"in place\" for Outputs, Detections, and <abbr title=\"LimaCharlie Extensions allow users to expand and customize their security environments by integrating third-party tools, automating workflows, and adding new capabilities. Organizations subscribe to Extensions, which are granted specific permissions to interact with their infrastructure. Extensions...\">Extensions</abbr> to accelerate troubleshooting</li>\n<li>Support text data types in extensions (e.g. for large inputs, per community request)</li>\n</ul>\n<p><strong>Bug fixes:</strong> Query console, <abbr title=\"Detection &amp; Response\">D&amp;R</abbr> rule creation flow, Console, File system.</p>",
      "date_published": "2025-10-17T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-10-13:release/web-app-5-1-0",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-510",
      "title": "Web App 5.1.0",
      "content_html": "<p>Substantial update of Access Management for clarity and convenience of user management. Continued refinement of the UX for user and group management.</p>\n<p><strong>Bug fixes:</strong> Artifact list, file system, and more.</p>",
      "date_published": "2025-10-13T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-09-30:release/web-app-5-0-0",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-500",
      "title": "Web App 5.0.0",
      "content_html": "<p>The Query Console is now in the new UI theme. Feature-rich search and analytic capabilities integrated with the rest of the LimaCharlie platform marks a major revision.</p>\n<div class=\"admonition note\">\n<p class=\"admonition-title\">Note</p>\n<p>The Query Console remains in beta while we continue to improve performance and refine usability.</p>\n</div>",
      "date_published": "2025-09-30T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-09-12:release/endpoint-agent-v4-33-15",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-v43315",
      "title": "Endpoint Agent v4.33.15",
      "content_html": "<ul>\n<li>macOS system extension: fixes for potential install and upgrade issues, improved logging for troubleshooting</li>\n<li>Fixes a macOS install issue when using the package installer (.pkg)</li>\n</ul>",
      "date_published": "2025-09-12T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-09-12:release/web-app-v4-5-0",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-v450",
      "title": "Web App v4.5.0",
      "content_html": "<p>Many bug fixes and some ongoing UX improvements.</p>",
      "date_published": "2025-09-12T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-08-28:release/endpoint-agent-4-33-14",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-43314",
      "title": "Endpoint Agent 4.33.14",
      "content_html": "<ul>\n<li>Reduce CPU usage of the OS tracker. The component is used for: new system service notifications, new driver notifications, and new autoruns/bootstrap notifications.</li>\n</ul>",
      "date_published": "2025-08-28T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-08-28:release/web-app-4-4-9",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-449",
      "title": "Web App 4.4.9",
      "content_html": "<ul>\n<li>Improved UX for Access Management and Adapters pages</li>\n<li>Add Wiz cloud sensor adapter integration</li>\n<li>Many fixes and smaller improvements</li>\n</ul>",
      "date_published": "2025-08-28T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-08-28:release/other-notable-updates",
      "url": "https://docs.limacharlie.io/10-release-notes/#other-notable-updates",
      "title": "Other Notable Updates",
      "content_html": "<ul>\n<li><strong>Org Templates</strong>: Re-introduction of org templates during org creation. Currently offering <abbr title=\"Endpoint Detection &amp; Response\">EDR</abbr> Quick Start and Basic Browser Monitoring to get the new org configured on creation. You can always add configurations as code using the <abbr title=\"Infrastructure as Code (IaC) automates the management and provisioning of IT infrastructure using code, making it easier to scale, maintain, and deploy resources consistently. In LimaCharlie, IaC allows security teams to deploy and manage sensors, rules, and other security infrastructure...\">IaC</abbr> Generator.</li>\n<li><strong>Parsing Unstructured Logs</strong>: With <code>parsing_grok</code> you can use OpenSearch Grok processor syntax, and tap into powerful ready-to-use Grok patterns and the vast knowledge of grokking data with Elastic.</li>\n</ul>",
      "date_published": "2025-08-28T00:00:00+00:00",
      "tags": [
        "platform"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-08-08:release/endpoint-agent-4-33-13-and-4-33-10-3",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-43313-and-433103",
      "title": "Endpoint Agent 4.33.13 and 4.33.10.3",
      "content_html": "<p>Fix a Windows 2016 compatibility issue in the kernel driver for both <code>lc:stable</code> (4.33.10.3) and <code>lc:latest</code> (4.33.13) versions.</p>",
      "date_published": "2025-08-08T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-07-18:release/endpoint-agent-4-33-11",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-43311",
      "title": "Endpoint Agent 4.33.11",
      "content_html": "<p><strong>Bug Fixes:</strong></p>\n<ul>\n<li>Resolved event loss on high-traffic Windows systems</li>\n<li>Fixed kernel upgrade failures that could occur during system updates</li>\n<li>Addressed code signing compatibility issues on macOS</li>\n</ul>\n<p><strong>Breaking Changes:</strong></p>\n<ul>\n<li>Console logging is now opt-in via <code>-v</code> or <code>--verbose</code> flags. The previous <code>-v</code> flag for displaying installer version has been changed to <code>-V</code>. This improves default output cleanliness while maintaining debugging capabilities.</li>\n</ul>\n<p>New stable version is now <strong>4.33.10</strong>.</p>",
      "date_published": "2025-07-18T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-07-18:release/web-app-4-4-4",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-444",
      "title": "Web App 4.4.4",
      "content_html": "<p>A patch release with minor bug fixes.</p>",
      "date_published": "2025-07-18T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-07-10:release/web-app-4-4-3",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-443",
      "title": "Web App 4.4.3",
      "content_html": "<p>Fixed regression with sensor timeline view.</p>",
      "date_published": "2025-07-10T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-07-10:release/lc-adapters-v1-30-11",
      "url": "https://docs.limacharlie.io/10-release-notes/#lc-adapters-v13011",
      "title": "LC Adapters v1.30.11",
      "content_html": "<p>Integration with Cylance, Proofpoint Tap, and Wiz. Big and special thanks to community contributors <a href=\"https://github.com/shortstack\">shortstack</a> and RagingRedRiot.</p>\n<div class=\"admonition note\">\n<p class=\"admonition-title\">Note</p>\n<p>These adapters are supported in the downloadable <abbr title=\"Adapters serve as flexible data ingestion mechanisms for both on-premise and cloud environments.\">Adapter</abbr>, but not yet rolled out to the web app as \"cloud adapter.\"</p>\n</div>",
      "date_published": "2025-07-10T00:00:00+00:00",
      "tags": [
        "adapters"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-06-27:release/endpoint-agent-4-33-9",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-4339",
      "title": "Endpoint Agent 4.33.9",
      "content_html": "<p>Important fixes for Windows 7 and Windows 8 support.</p>",
      "date_published": "2025-06-27T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-06-27:release/web-app-4-1-2",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-412",
      "title": "Web App 4.1.2",
      "content_html": "<p>Bug fixes for customers and community.</p>",
      "date_published": "2025-06-27T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-06-27:release/new-community-rule-sets",
      "url": "https://docs.limacharlie.io/10-release-notes/#new-community-rule-sets",
      "title": "New Community Rule Sets",
      "content_html": "<p>Two new rule sets from community partners added to the LimaCharlie Add-Ons collection:</p>\n<ul>\n<li><strong>SoteriaSec Commercial Ruleset</strong>: Google Workspace Rules</li>\n<li><strong>BLOKWORX Detection &amp; Response</strong>: Rules covering detection of a collection of remote access services usage</li>\n</ul>",
      "date_published": "2025-06-27T00:00:00+00:00",
      "tags": [
        "platform"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-06-17:release/web-app-4-4-0",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-440",
      "title": "Web App 4.4.0",
      "content_html": "<ul>\n<li><strong>AI-powered community rules (Beta)</strong>: Easy way to turn thousands of community rules into LimaCharlie detection &amp; response rules.</li>\n<li>New and improved <abbr title=\"LimaCharlie Extensions allow users to expand and customize their security environments by integrating third-party tools, automating workflows, and adding new capabilities. Organizations subscribe to Extensions, which are granted specific permissions to interact with their infrastructure. Extensions...\">Extensions</abbr> page</li>\n<li>Bug fixes, including a few around auto-generated <abbr title=\"LimaCharlie Extensions allow users to expand and customize their security environments by integrating third-party tools, automating workflows, and adding new capabilities. Organizations subscribe to Extensions, which are granted specific permissions to interact with their infrastructure. Extensions...\">Extensions</abbr> UI for extension builders</li>\n</ul>",
      "date_published": "2025-06-17T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-05-30:release/endpoint-agent-4-33-8",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-4338",
      "title": "Endpoint Agent 4.33.8",
      "content_html": "<ul>\n<li>Fix a potential deadlock on upgrade in the HBS component</li>\n<li>Fix a reverse logic issue processing the <code>LC_DISABLE_REVERSE_DNS_HOSTNAME</code> environment variable. Accepted values: <code>1</code>, <code>true</code>, <code>0</code>, <code>false</code> (case insensitive)</li>\n</ul>",
      "date_published": "2025-05-30T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-05-30:release/web-app-4-3-3",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-433",
      "title": "Web App 4.3.3",
      "content_html": "<p>AI-assisted detection read-out, navigation improvements, showing org selector consistently, and a number of bug fixes.</p>",
      "date_published": "2025-05-30T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-05-22:release/endpoint-agent-4-33-7",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-4337",
      "title": "Endpoint Agent 4.33.7",
      "content_html": "<p><strong>Linux:</strong></p>\n<ul>\n<li>Fix some Linux GLIBC compatibility issues. The minimum GLIBC supported version is now 2.17 (released 2012) for all 3 supported architectures (x86, x86_64, and ARM64)</li>\n<li>Fix the Linux Alpine / musl libc binaries</li>\n</ul>\n<p><strong>macOS:</strong></p>\n<ul>\n<li>Standalone installer is now a universal binary (FAT) to prevent users from installing on the wrong architecture</li>\n<li>Fix an issue where the host isolation command wouldn't terminate existing connections</li>\n</ul>\n<p><strong>Windows:</strong></p>\n<ul>\n<li>Added an environment variable (<code>LC_LOCAL_CACHE_ONLY_REVOCATION_CHECK</code>) to prevent the Windows WinTrust code signing library from updating its revocation cache from the internet. The default and recommended setting is to let WinTrust update its cache, but the sensor may connect to content delivery networks (CDNs) on port 80 to do so.</li>\n</ul>\n<p><strong>General:</strong></p>\n<ul>\n<li>The sensor troubleshooting tool (<code>rphcp -H</code>) was missing in the .deb, .msi, and .pkg installers</li>\n</ul>",
      "date_published": "2025-05-22T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-05-22:release/web-app-4-3-2",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-432",
      "title": "Web App 4.3.2",
      "content_html": "<p>Fixes for a few edge-case crashes and recently reported bugs.</p>",
      "date_published": "2025-05-22T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-05-20:release/limacharlie-endpoint-protection",
      "url": "https://docs.limacharlie.io/10-release-notes/#limacharlie-endpoint-protection",
      "title": "LimaCharlie Endpoint Protection",
      "content_html": "<p>Releasing LimaCharlie Endpoint Protection, which integrates with third-party <abbr title=\"Endpoint Detection &amp; Response\">EDR</abbr> solutions to provide a better view of security operations and extend agent capabilities. This functionality comprises the EPP <abbr title=\"LimaCharlie Extensions allow users to expand and customize their security environments by integrating third-party tools, automating workflows, and adding new capabilities. Organizations subscribe to Extensions, which are granted specific permissions to interact with their infrastructure. Extensions...\">Extension</abbr>, Web App, and a previously released <abbr title=\"Endpoint Agents are lightweight software agents deployed directly on endpoints like workstations and servers. These sensors collect real-time data related to system activity, network traffic, file changes, process behavior, and much more.\">Endpoint Agent</abbr> v4.33.6.</p>",
      "date_published": "2025-05-20T00:00:00+00:00",
      "tags": [
        "platform"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-05-20:release/web-app-4-3-1",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-431",
      "title": "Web App 4.3.1",
      "content_html": "<p>UI support for Endpoint Protection solution, bug fixes.</p>",
      "date_published": "2025-05-20T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-05-20:release/extensions",
      "url": "https://docs.limacharlie.io/10-release-notes/#extensions",
      "title": "Extensions",
      "content_html": "<p>Endpoint Protection extension: a component of the EPP solution that codifies key configurations for Microsoft Defender.</p>",
      "date_published": "2025-05-20T00:00:00+00:00",
      "tags": [
        "extensions"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-05-08:release/lc-adapter-v1-30-1",
      "url": "https://docs.limacharlie.io/10-release-notes/#lc-adapter-v1301",
      "title": "LC Adapter v1.30.1",
      "content_html": "<p>Adding Sublime adapter. Audit logs from Sublime can be ingested cloud-to-cloud via the API.</p>",
      "date_published": "2025-05-08T00:00:00+00:00",
      "tags": [
        "adapters"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-05-08:release/web-app-4-2-8",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-428",
      "title": "Web App 4.2.8",
      "content_html": "<p>A number of UI bug fixes.</p>",
      "date_published": "2025-05-08T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-04-18:release/endpoint-agent-4-33-6",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-4336",
      "title": "Endpoint Agent 4.33.6",
      "content_html": "<ul>\n<li>Allow the sensor to drop the VDI file (delayed start) during the installation procedure via <code>-t</code></li>\n<li>Added a sensor troubleshooting utility: a standalone command and a command line option for the sensor (<code>-H</code>) to help diagnose common misconfigurations and connectivity problems</li>\n</ul>",
      "date_published": "2025-04-18T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-04-18:release/web-app-4-2-3",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-423",
      "title": "Web App 4.2.3",
      "content_html": "<p>Fixing the artifact download broken in some cases, and other small bug fixes.</p>",
      "date_published": "2025-04-18T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-04-11:release/web-app-4-2-1",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-421",
      "title": "Web App 4.2.1",
      "content_html": "<ul>\n<li><strong>AI co-writer for <abbr title=\"Detection &amp; Response\">D&amp;R</abbr></strong>: Use \"ask AI\" when creating a rule and it helps you write a detection and response based on your prompt. Currently uses Google's Gemini 2 Flash model tuned for LimaCharlie <abbr title=\"Detection &amp; Response\">D&amp;R</abbr> rules. Standard AI disclaimer applies: \"trust but verify.\"</li>\n<li><strong>Event Tree</strong>: Updated for usability and performance on giant trees. Enjoy collapsing and expanding groups of events, and traverse the tree with no strain on your browser.</li>\n<li>Other performance optimizations and bug fixes</li>\n</ul>",
      "date_published": "2025-04-11T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-04-11:release/endpoint-agent-4-33-5",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-4335",
      "title": "Endpoint Agent 4.33.5",
      "content_html": "<ul>\n<li>Performance improvements for macOS</li>\n<li>Infrastructure work to support Endpoint Protection Platforms (EPP), and added support for Microsoft Windows Defender</li>\n</ul>\n<div class=\"admonition note\">\n<p class=\"admonition-title\">Note of Change</p>\n<p>LC Detection Events are now immutable. One can no longer remove past events or modify them in any way, as detection events are a factual historic record and it's prudent to keep them as such.</p>\n</div>",
      "date_published": "2025-04-11T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-03-28:release/web-app-4-1-4",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-414",
      "title": "Web App 4.1.4",
      "content_html": "<p>UI betterment: quick filters for common platforms on the <abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> list, reliable navigation from/to Detections, other small improvements and bug fixes.</p>",
      "date_published": "2025-03-28T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-03-28:release/adapters",
      "url": "https://docs.limacharlie.io/10-release-notes/#adapters",
      "title": "Adapters",
      "content_html": "<p>SentinelOne adapter: connects to SentinelOne MGMT API and sends alerts, threats, and other events of interest to LimaCharlie.</p>",
      "date_published": "2025-03-28T00:00:00+00:00",
      "tags": [
        "adapters"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-03-28:release/endpoint-agent-v4-33-4",
      "url": "https://docs.limacharlie.io/10-release-notes/#endpoint-agent-v4334",
      "title": "Endpoint Agent v4.33.4",
      "content_html": "<ul>\n<li>Fix missing pipe event for Windows</li>\n<li>Fix the kernel acquisition module for Linux ARM64 builds</li>\n</ul>",
      "date_published": "2025-03-28T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-03-28:release/extensions-and-adapters",
      "url": "https://docs.limacharlie.io/10-release-notes/#extensions-and-adapters",
      "title": "Extensions and Adapters",
      "content_html": "<ul>\n<li><strong>Git-Sync</strong>: Take the best from LimaCharlie <abbr title=\"Infrastructure as Code (IaC) automates the management and provisioning of IT infrastructure using code, making it easier to scale, maintain, and deploy resources consistently. In LimaCharlie, IaC allows security teams to deploy and manage sensors, rules, and other security infrastructure...\">Infrastructure as Code</abbr> by connecting with Git and syncing the desired sections of your configurations in an easy-to-use UI. See <a href=\"https://docs.limacharlie.io/5-integrations/extensions/limacharlie/git-sync/\">documentation</a>.</li>\n<li><strong>ext-renigma v1.0.0</strong>: Initial release of integration with REnigma, an advanced malware analysis platform leveraging its unique Record and Replay technology.</li>\n<li><strong>Mimecast adapter</strong>: Connect to the Mimecast API to stream audit events as they happen.</li>\n</ul>",
      "date_published": "2025-03-28T00:00:00+00:00",
      "tags": [
        "extensions",
        "adapters"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-03-28:release/web-app-4-1-1",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-411",
      "title": "Web App 4.1.1",
      "content_html": "<p>Usability improvements on Detection page, ability to re-run command in sensor console, fix \"copy array index,\" and numerous bug fixes.</p>",
      "date_published": "2025-03-28T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-03-14:release/web-app-v4-0-2",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-v402",
      "title": "Web App v4.0.2",
      "content_html": "<ul>\n<li>A long-awaited modernized UI is available (in preview). More work is on the way to further improve user experience.</li>\n<li>In-product dashboards available (in preview): a bird's eye view on key detections and the flow of data.</li>\n</ul>\n<p>This is not just a paint job: we made substantial internal changes and will continue to improve quality.</p>\n<div class=\"admonition note\">\n<p class=\"admonition-title\">Note</p>\n<p>On large orgs, the dashboards can take up to 15 seconds to load the very first time, and normalize after the first load. Optimizations are on the way.</p>\n<p>The Query Console is not available in the Modern UI yet. We will bring it there in a much better shape. In the meantime, switch back to the Old Theme to access it.</p>\n</div>",
      "date_published": "2025-03-14T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-03-14:release/add-ons-and-adapters",
      "url": "https://docs.limacharlie.io/10-release-notes/#add-ons-and-adapters",
      "title": "Add-Ons and Adapters",
      "content_html": "<ul>\n<li><strong>PandaDoc adapter</strong>: Connect and fetch PandaDoc API logs.</li>\n<li><strong>CrowdStrike Falcon Cloud adapter</strong>: Connect to CrowdStrike Falcon Cloud to stream events as they happen in the CrowdStrike Falcon Console.</li>\n<li><strong>Cloud-<abbr title=\"Command-line Interface\">CLI</abbr> v1.4.8 <abbr title=\"LimaCharlie Extensions allow users to expand and customize their security environments by integrating third-party tools, automating workflows, and adding new capabilities. Organizations subscribe to Extensions, which are granted specific permissions to interact with their infrastructure. Extensions...\">Extension</abbr></strong>: Improved observability in <abbr title=\"Command-line Interface\">CLI</abbr> extensions such as ext-cloud-cli. Additionally, improved error handling and reporting around long-running <abbr title=\"Command-line Interface\">CLI</abbr> commands which may have gotten stuck or timed out.</li>\n</ul>",
      "date_published": "2025-03-14T00:00:00+00:00",
      "tags": [
        "extensions",
        "adapters"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-03-06:release/edr-agent-v4-33-2",
      "url": "https://docs.limacharlie.io/10-release-notes/#edr-agent-v4332",
      "title": "EDR Agent v4.33.2",
      "content_html": "<p>Fixed a path expansion issue that would cause the cleanup command on Windows to leave configuration files after the uninstallation procedure.</p>",
      "date_published": "2025-03-06T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-03-06:release/adapter-v1-27-2",
      "url": "https://docs.limacharlie.io/10-release-notes/#adapter-v1272",
      "title": "Adapter v1.27.2",
      "content_html": "<p>Added support for ZenDesk.</p>",
      "date_published": "2025-03-06T00:00:00+00:00",
      "tags": [
        "adapters"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-02-28:release/limacharlie-labs",
      "url": "https://docs.limacharlie.io/10-release-notes/#limacharlie-labs",
      "title": "LimaCharlie Labs",
      "content_html": "<p>Introducing LimaCharlie Labs, where we share brave experiments and early prototypes of features and extensions that may or may not become production, based on your input and feedback. Check the LABS badge on the Web App.</p>\n<p><strong>Playbook <abbr title=\"LimaCharlie Extensions allow users to expand and customize their security environments by integrating third-party tools, automating workflows, and adding new capabilities. Organizations subscribe to Extensions, which are granted specific permissions to interact with their infrastructure. Extensions...\">Extension</abbr></strong> is now available in Labs.</p>",
      "date_published": "2025-02-28T00:00:00+00:00",
      "tags": [
        "platform"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-02-28:release/web-app-v3-10-1",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-v3101",
      "title": "Web App v3.10.1",
      "content_html": "<ul>\n<li>Introduce Event Latency (<code>routing/latency</code>), and add latency metrics to <abbr title=\"Similar to agents, Sensors send telemetry to the LimaCharlie platform in the form of EDR telemetry or forwarded logs. Sensors are offered as a scalable, serverless solution for securely connecting endpoints of an organization to the cloud.\">Sensor</abbr> Analytics, to help identify and troubleshoot event latency issues</li>\n<li>Add \"Search by Description\" to the org list</li>\n<li>Bug fixes</li>\n<li><strong>Report a Bug</strong>: Integrated tool to report bugs easily</li>\n</ul>",
      "date_published": "2025-02-28T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-02-21:release/web-app-v3-9-3",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-v393",
      "title": "Web App v3.9.3",
      "content_html": "<p>Bug fixes: handling edge-cases of org creation and adding users flows, fixing MS 365 sensor false status in certain rare conditions, other small fixes and internal instrumentation improvements.</p>",
      "date_published": "2025-02-21T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-02-21:release/cli-4-9-12",
      "url": "https://docs.limacharlie.io/10-release-notes/#cli-4912",
      "title": "CLI 4.9.12",
      "content_html": "<p>Add users, simplified. Wrapping the new API, a new command <code>limacharlie users invite</code> makes it easy to add a user, or a batch of users, to the org without requiring them to create a LimaCharlie account.</p>",
      "date_published": "2025-02-21T00:00:00+00:00",
      "tags": [
        "cli"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-02-21:release/edr-endpoint-agent-v4-33-1",
      "url": "https://docs.limacharlie.io/10-release-notes/#edr-endpoint-agent-v4331",
      "title": "EDR Endpoint Agent v4.33.1",
      "content_html": "<ul>\n<li>Fix various directory and file permissions on macOS</li>\n<li>\n<p>Added a status file to help troubleshooting. The status file contains the sensor ID, organization ID, version, and the agent's service uptime.</p>\n<p><strong>Status file locations:</strong></p>\n<table>\n<thead>\n<tr>\n<th>Platform</th>\n<th>Path</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Linux</td>\n<td><code>/opt/limacharlie/hcp_hbs_status.json</code></td>\n</tr>\n<tr>\n<td>macOS</td>\n<td><code>/Library/Application Support/limacharlie/hcp_hbs_status.json</code></td>\n</tr>\n<tr>\n<td>Windows</td>\n<td><code>C:\\ProgramData\\limacharlie\\hcp_hbs_status.json</code></td>\n</tr>\n</tbody>\n</table>\n</li>\n<li>\n<p>Fix a missing package name for Microsoft Edge Update on Windows</p>\n</li>\n<li>Fix a pattern matching issue that was affecting file integrity notifications</li>\n<li>Added the <code>LC_DISABLE_REVERSE_DNS_HOSTNAME</code> environment variable for customers wanting to use the local hostname instead of resolving it</li>\n</ul>",
      "date_published": "2025-02-21T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-01-24:release/web-app-v3-8-12",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-v3812",
      "title": "Web App v3.8.12",
      "content_html": "<p><strong>New Features:</strong></p>\n<ul>\n<li><strong>New Australia Datacenter</strong>: Added a new datacenter in Australia to enhance performance and availability for users in the region.</li>\n<li><strong>Secrets Manager Integration</strong>: The SMTP password field now allows integration with the secrets manager, providing a more secure way to handle authentication credentials.</li>\n<li><strong>New <abbr title=\"LimaCharlie Extensions allow users to expand and customize their security environments by integrating third-party tools, automating workflows, and adding new capabilities. Organizations subscribe to Extensions, which are granted specific permissions to interact with their infrastructure. Extensions...\">Extension</abbr></strong>: ext-nims allows you to send detections from LimaCharlie to NIMS via the Notion API.</li>\n</ul>\n<p><strong>Bug Fixes and Enhancements:</strong></p>\n<ul>\n<li><strong>Autofill OTP</strong>: The one-time password (OTP) field now properly auto-fills from password managers.</li>\n<li><strong>User Permissions Warning</strong>: A warning message has been implemented to notify users when revoking permissions for a user.</li>\n</ul>",
      "date_published": "2025-01-24T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-01-09:release/web-app-v3-8-10",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-v3810",
      "title": "Web App v3.8.10",
      "content_html": "<p><strong>Bug Fixes and Improvements:</strong></p>\n<ul>\n<li>Fixed a bug where creating a new secret in a secret manager and changing cloud adapter configuration at the same time would not update the cloud configuration with the new secret.</li>\n</ul>",
      "date_published": "2025-01-09T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2025-01-09:release/ext-usage-alerts-v1-0-0",
      "url": "https://docs.limacharlie.io/10-release-notes/#ext-usage-alerts-v100",
      "title": "ext-usage-alerts v1.0.0",
      "content_html": "<p>Newly released extension which allows you to create, maintain, and automatically refresh usage alert conditions for an organization.</p>",
      "date_published": "2025-01-09T00:00:00+00:00",
      "tags": [
        "extensions"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2024-12-12:release/web-app-v3-8-8",
      "url": "https://docs.limacharlie.io/10-release-notes/#web-app-v388",
      "title": "Web App v3.8.8",
      "content_html": "<p><strong>New Features:</strong></p>\n<ul>\n<li>Introduced user-level saved queries for improved data management.</li>\n</ul>\n<p><strong>Bug Fixes and Improvements:</strong></p>\n<ul>\n<li>Fixed the alignment of the \"skip for now\" text on the initial sensor onboarding screen during organization creation.</li>\n<li>Resolved an error related to empty extension configurations.</li>\n<li>Fixed a minor horizontal scroll issue on the sensors page.</li>\n<li>Fixed an issue where the organization creation waiting room would display \"missing permission errors\" when opening the app.</li>\n<li>Minor enhancement on the input field for adding a user to your organization, where it will now show an error if the \"add user\" button is clicked without an email filled in.</li>\n<li>Updated various mentions of \"Yara\" to be all caps to reflect it being an acronym.</li>\n</ul>",
      "date_published": "2024-12-12T00:00:00+00:00",
      "tags": [
        "web-app"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2024-10-28:release/new-mitre-report-api",
      "url": "https://docs.limacharlie.io/10-release-notes/#new-mitre-report-api",
      "title": "New MITRE Report API",
      "content_html": "<p>Added a new REST API and <abbr title=\"Command-line Interface\">CLI</abbr> for producing a MITRE report for a given organization based on the <abbr title=\"Detection &amp; Response\">D&amp;R</abbr> rules in place (using their tags like <code>attack..t1000.xxx</code>).</p>\n<ul>\n<li><strong><abbr title=\"Command-line Interface\">CLI</abbr></strong>: <code>limacharlie mitre-report</code></li>\n</ul>\n<p>The resulting JSON report can be used with the <a href=\"https://mitre-attack.github.io/attack-navigator/\">ATT&amp;CK Navigator</a>. This capability makes it easier to track security coverage against the MITRE ATT&amp;CK framework.</p>",
      "date_published": "2024-10-28T00:00:00+00:00",
      "tags": [
        "platform"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2024-10-19:release/edr-sensor-v4-31-1",
      "url": "https://docs.limacharlie.io/10-release-notes/#edr-sensor-v4311",
      "title": "EDR Sensor v4.31.1",
      "content_html": "<p>Network connection stability enhancements on all platforms.</p>\n<p>The enhancements are in both the cloud-triggered upgrade version of the sensor AND in the on-disk installation, but there is no requirement to deploy both simultaneously.</p>",
      "date_published": "2024-10-19T00:00:00+00:00",
      "tags": [
        "endpoint-agent"
      ]
    },
    {
      "id": "tag:docs.limacharlie.io,2024-10-17:release/new-sort-and-bulk-actions-for-tables",
      "url": "https://docs.limacharlie.io/10-release-notes/#new-sort-and-bulk-actions-for-tables",
      "title": "New Sort and Bulk Actions for Tables",
      "content_html": "<p>Added the ability to sort columns in the LimaCharlie web app. In addition, tables now support bulk actions (Enable/Disable and Delete). This applies to the following sections: Adapters, YARA Rules, Secrets, Lookups, False Positive Rules, and Detection and Response Rules.</p>\n<!-- Glossary definitions for tooltip abbreviations -->\n<!-- Auto-generated from glossary CSV - do not edit manually -->",
      "date_published": "2024-10-17T00:00:00+00:00",
      "tags": [
        "platform"
      ]
    }
  ]
}