LimaCharlie Release Notes: Platform

Platform: Multi-Provider AI Sessions

Thu, 20 Aug 2026 00:00:00 GMT

New Features

AI provider choice for user sessions: user AI Sessions can now run on OpenAI (API key or Azure OpenAI), Google Gemini (AI Studio key or Vertex AI service account), and OpenRouter, in addition to Claude. Connect your own provider credentials under User Settings → AI Terminal (or via the API) and pick the provider on a session profile. Tool use and approvals, MCP servers, USD budget caps, hibernation, forking, and cost tracking work the same on every provider; a few capabilities stay Claude-only (plan mode, bypassPermissions, Task subagents, extended thinking). See AI Providers.

Vulnerability Management Uplift

Sat, 09 May 2026 00:00:00 GMT

Major uplift to the Vulnerability Reporting extension and its surfaces.

Canonical asset-tag namespace: introduces the lc:asset:* tag convention (criticality, exposure, environment, owner, compliance) for cross-cutting asset metadata. The Vulnerability Reporting extension is the first consumer; the namespace is intended to be reused across LimaCharlie surfaces. See Asset Tag Namespace.
Vulnerability Reporting extension: new public-facing documentation covering setup, scan modes (scheduled / manual / all), criticality-tag overrides, KEV + EPSS enrichment, LC Risk scoring, and the full action surface. See Vulnerability Reporting.
Finding resolutions: documented the resolution model — every finding is implicitly open until an operator records mitigated, accepted, or false_positive. Accepted-exception expiries lapse back into the open count, and vuln_finding.* events (created, closed, kev_match, state_changed) can be routed via Outputs to Jira, Slack, Cases, etc.

Other Notable Updates

Thu, 28 Aug 2025 00:00:00 GMT

Org Templates: Re-introduction of org templates during org creation. Currently offering EDR Quick Start and Basic Browser Monitoring to get the new org configured on creation. You can always add configurations as code using the IaC Generator.
Parsing Unstructured Logs: With parsing_grok you can use OpenSearch Grok processor syntax, and tap into powerful ready-to-use Grok patterns and the vast knowledge of grokking data with Elastic.

New Community Rule Sets

Fri, 27 Jun 2025 00:00:00 GMT

Two new rule sets from community partners added to the LimaCharlie Add-Ons collection:

SoteriaSec Commercial Ruleset: Google Workspace Rules
BLOKWORX Detection & Response: Rules covering detection of a collection of remote access services usage

LimaCharlie Endpoint Protection

Tue, 20 May 2025 00:00:00 GMT

Releasing LimaCharlie Endpoint Protection, which integrates with third-party EDR solutions to provide a better view of security operations and extend agent capabilities. This functionality comprises the EPP Extension, Web App, and a previously released Endpoint Agent v4.33.6.

LimaCharlie Labs

Fri, 28 Feb 2025 00:00:00 GMT

Introducing LimaCharlie Labs, where we share brave experiments and early prototypes of features and extensions that may or may not become production, based on your input and feedback. Check the LABS badge on the Web App.

Playbook Extension is now available in Labs.

New MITRE Report API

Mon, 28 Oct 2024 00:00:00 GMT

Added a new REST API and CLI for producing a MITRE report for a given organization based on the D&R rules in place (using their tags like attack..t1000.xxx).

CLI: limacharlie mitre-report

The resulting JSON report can be used with the ATT&CK Navigator. This capability makes it easier to track security coverage against the MITRE ATT&CK framework.

New Sort and Bulk Actions for Tables

Thu, 17 Oct 2024 00:00:00 GMT

Added the ability to sort columns in the LimaCharlie web app. In addition, tables now support bulk actions (Enable/Disable and Delete). This applies to the following sections: Adapters, YARA Rules, Secrets, Lookups, False Positive Rules, and Detection and Response Rules.