Skip to content

LimaCharlie Documentation

Overview

Initializing search

refractionPOINT/documentation

Home
Getting Started
Sensors
Detection & Response
Data & Queries
Integrations
Developer Guide
Administration
Reference
AI Sessions
Release Notes

LimaCharlie Documentation

refractionPOINT/documentation

Home
Getting Started
Getting Started
- What is LimaCharlie?
- Quickstart
- Core Concepts
- Tutorials
  Tutorials
Sensors
Sensors
- Installation Keys
- Sensor Connectivity
- Sensor Tags
- Log Collection Guide
- Telemetry Index
- Endpoint Agents
  Endpoint Agents
  - Windows
    Windows
    
    Installation
    
    Custom MSI
  - macOS
    macOS
    
    Installation (Sequoia+)
    
    Installation (Catalina-Sonoma)
    
    Installation (Older)
    
    MDM Profiles
    
    Jamf
    
    Intune
  - Linux
    Linux
    
    Installation
  - Chrome
  - Edge
  - Docker
  - Containers
  - VDI Templates
  - Payloads
  - Versioning & Upgrades
  - Service Upgrades
  - Uninstallation
  - Hostname Resolution
  - Sleeper Mode
- Enterprise Deployment
  Enterprise Deployment
  - Chrome Enterprise
  - Intune
- Adapters
  Adapters
  - Deployment
  - As a Service
  - Usage
  - Cloud Providers
    Cloud Providers
    
    AWS CloudTrail
    
    AWS GuardDuty
    
    AWS S3
    
    AWS SQS
    
    Azure Event Hub
    
    GCP Pub/Sub
    
    GCP Storage
  - Azure Services
    Azure Services
    
    Key Vault
    
    Kubernetes Service
    
    Monitor
    
    Network Security Group
    
    SQL Audit Logs
  - Identity & Access
    Identity & Access
    
    Okta
    
    Microsoft Entra ID
    
    Duo
    
    1Password
  - Security Tools
    Security Tools
    
    CrowdStrike
    
    Microsoft Defender
    
    SentinelOne
    
    Sophos
    
    Carbon Black
    
    Sublime Security
  - Collaboration
    Collaboration
    
    Microsoft 365
    
    Slack Audit
    
    Google Workspace
    
    Atlassian
    
    HubSpot
    
    Zendesk
    
    PandaDoc
    
    Mimecast
  - Infrastructure
    Infrastructure
    
    Kubernetes Pods
    
    IIS
    
    Cato
    
    Tailscale
  - Generic
    Generic
    
    Syslog
    
    JSON
    
    File
    
    Stdin
    
    Windows Event Log
    
    EVTX
    
    Mac Unified Logging
    
    IMAP
  - Other
    Other
    
    Canary Tokens
    
    IT Glue
  - Examples
    Examples
    
    Stdin JSON
    
    Stdin
    
    Windows Event Logs
  - Tutorials
    Tutorials
    
    Webhook Adapter
    
    OpenTelemetry via Webhook
    
    Google Cloud Logs
    
    Cloud Telemetry
- Troubleshooting
  Troubleshooting
  - Non-Responding Sensors
- Tutorials
  Tutorials
Detection & Response
Detection & Response
- Writing & Testing Rules
- Threat Feed Rule
- D&R Rule Building Guidebook
- Examples
- False Positive Rules
- Stateful Rules
- Sensor Variables
- Behavioral Detection
- Unit Tests
- Alternate Targets
- Managed Rulesets
  Managed Rulesets
Data & Queries
Data & Queries
- LCQL Examples
- Query Console UI
- Query CLI
- Template Strings
- Template Transforms
- Events
  Events
  - Sysmon Comparison
- Tutorials
  Tutorials
  - BigQuery + Looker Studio
Integrations
Integrations
- Add-ons
- Outputs
  Outputs
  - Stream Structures
  - Testing
  - Allowlisting
  - Billing
  - Destinations
    Destinations
    
    Amazon S3
    
    Splunk
    
    Elastic
    
    BigQuery
    
    Syslog
    
    Webhook
    
    Webhook Bulk
    
    Slack
    
    SMTP
    
    Apache Kafka
    
    Azure Event Hub
    
    Azure Storage Blob
    
    Google Cloud Storage
    
    Google Pub/Sub
    
    Humio
    
    OpenSearch
    
    SCP
    
    SFTP
    
    Tines
- Extensions
  Extensions
  - Using Extensions
  - LimaCharlie
    LimaCharlie
    
    Git Sync
    
    Reliable Tasking
    
    YARA Manager
    
    Artifact
    
    BinLib
    
    Infrastructure
    
    Usage Alerts
    
    Dumper
    
    EPP
    
    Exfil
    
    Integrity
    
    Lookup Manager
    
    Payload Manager
    
    Sensor Cull
    
    Cases
  - Third Party
    Third Party
    
    Velociraptor
    
    Zeek
    
    YARA
    
    Hayabusa
    
    Atomic Red Team
    
    OTX
    
    PagerDuty
    
    Plaso
    
    Strelka
    
    Twilio
    
    Govee
    
    NIMS
    
    Renigma
    
    SecureAnnex
  - Labs
    Labs
    
    Playbook
  - Cloud CLI
    Cloud CLI
    
    1Password
    
    AWS
    
    Azure
    
    DigitalOcean
    
    GitHub
    
    Google Cloud
    
    Microsoft 365
    
    Okta
    
    SDM
    
    Sublime
    
    Tailscale
    
    Vultr
- API Integrations
  API Integrations
- Services
  Services
  - Replay
  - Dumper
- Tutorials
  Tutorials
Developer Guide
Developer Guide
- SDKs
  SDKs
  - Python SDK
  - Go SDK
- Command Line Interface
- CLI Extension
- Connecting AI Assistants
- Building Extensions
  Building Extensions
- Grant Program
Administration
Administration
- Access
  Access
  - API Keys
  - User Access
  - SSO
- Billing
  Billing
- Config Hive
  Config Hive
  - Secrets
  - Lookups
  - D&R Rules
  - YARA
  - Cloud Sensors
  - Investigation
Reference
Reference
AI Sessions
AI Sessions
Release Notes
Release Notes

Table of contents

Available Integrations

Home
Integrations
API Integrations

API Integrations¶

Connect to external threat intelligence and security services.

Available Integrations¶

AlphaMountain
EchoTrail
GreyNoise
Hybrid Analysis
IP ASN
IP Geolocation
Pangea
VirusTotal

Copyright © 2018-2025 refractionPOINT

Made with Material for MkDocs