Reference: Endpoint Agent Commands¶
Supported Commands by OS¶
For commands which emit a report/reply event type from the agent, the corresponding event type is provided.
Command Descriptions¶
artifact_get¶
Collect an artifact from a sensor by specifying a file path.
Platforms: macOS | Windows | Linux
Parameters:
file(required): File path to collect from the sensortype(optional): Artifact type (e.g., "pcap")payload_id(optional): Idempotent payload ID for the request (auto-generated if not provided)days_retention(optional): Number of days the artifact should be retained (default: 30)is_ignore_cert(optional): If set, the sensor will ignore SSL certificate mismatches during artifact upload
Response Event: FILE_GET_REP
Usage Example:
dir_list¶
List files and directories at a specified path on the endpoint.
Platforms: macOS | Windows | Linux
Parameters:
rootdir(positional): Root directory where to begin the listing fromfileexp(positional): File name expression supporting basic wildcards like*and?(e.g., "*.exe")-d, --depth(optional): Maximum depth of the listing, defaults to a single level
Response Event: DIR_LIST_REP
Usage Example:
Sample Response:
{
"event": {
"DIRECTORY_LIST": [
{
"FILE_PATH": "C:\\Windows\\System32\\cmd.exe",
"FILE_SIZE": 289792,
"LAST_MODIFIED": 1579000000
}
]
}
}
dir_findhash¶
Search for files matching a specific hash across a directory tree.
Platforms: macOS | Windows | Linux
Parameters:
dir_path(required): Root directory to searchhash(required): Hash value to search for (MD5, SHA1, or SHA256)depth(optional): Maximum recursion depth
Response Event: DIR_FINDHASH_REP
Usage Example:
dns_resolve¶
Perform DNS resolution on the endpoint to determine what DNS server responds.
Platforms: macOS | Windows | Linux | Chrome | Edge
Parameters:
hostname(required): Hostname to resolve
Response Event: DNS_REQUEST
Usage Example:
doc_cache_get¶
Retrieve a previously cached document from the sensor's local cache.
Platforms: macOS | Windows
Parameters:
hash(required): Hash of the cached document
Response Event: GET_DOCUMENT_REP
Usage Example:
exfil_add¶
Add an exfiltration detection watch for specific event types and patterns.
Platforms: macOS | Windows | Linux
Parameters:
event(required): Event type to monitor (e.g., "DNS_REQUEST", "NEW_PROCESS")operator(required): Comparison operator ("is", "contains", "matches", etc.)path(required): JSON path to the field to watch (e.g., "event/DOMAIN_NAME")value(required): Value or pattern to matchexpire(optional): TTL in seconds for the watch (default: permanent)
Response Event: EXFIL_ADD_REP
Usage Example:
limacharlie sensor task <SID> exfil_add --event "DNS_REQUEST" --operator "contains" --path "event/DOMAIN_NAME" --value "malware" --expire 3600
exfil_del¶
Remove an exfiltration detection watch by its ID.
Platforms: macOS | Windows | Linux
Parameters:
id(required): Watch ID to remove (from exfil_get response)
Response Event: EXFIL_DEL_REP
Usage Example:
exfil_get¶
List all active exfiltration detection watches on the sensor.
Platforms: macOS | Windows | Linux
Parameters: None
Response Event: EXFIL_GET_REP
Usage Example:
file_del¶
Delete a file from the endpoint filesystem.
Platforms: macOS | Windows | Linux
Parameters:
file_path(required): Path to the file to delete
Response Event: FILE_DEL_REP
Usage Example:
file_get¶
Retrieve a file from the endpoint and upload it to LimaCharlie cloud storage.
Platforms: macOS | Windows | Linux
Parameters:
file_path(required): Path to the file to retrieve
Response Event: FILE_GET_REP
Usage Example:
file_hash¶
Calculate cryptographic hashes (MD5, SHA1, SHA256) for a file.
Platforms: macOS | Windows | Linux
Parameters:
file_path(required): Path to the file to hash
Response Event: FILE_HASH_REP
Usage Example:
Sample Response:
{
"event": {
"FILE_PATH": "/etc/passwd",
"HASH": "abc123...",
"MD5": "def456...",
"SHA1": "ghi789...",
"SHA256": "jkl012..."
}
}
file_info¶
Get detailed metadata about a file without retrieving its contents.
Platforms: macOS | Windows | Linux
Parameters:
file_path(required): Path to the file
Response Event: FILE_INFO_REP
Usage Example:
Sample Response:
{
"event": {
"FILE_PATH": "C:\\Program Files\\app.exe",
"FILE_SIZE": 1048576,
"CREATED": 1579000000,
"MODIFIED": 1580000000,
"ACCESSED": 1581000000
}
}
file_mov¶
Move or rename a file on the endpoint filesystem.
Platforms: macOS | Windows | Linux
Parameters:
src_path(required): Source file pathdst_path(required): Destination file path
Response Event: FILE_MOV_REP
Usage Example:
fim_add¶
Add a File Integrity Monitoring (FIM) watch for a specific path or pattern.
Platforms: macOS | Windows | Linux
Parameters:
file_path(required): Path or pattern to monitor (supports wildcards)
Response Event: FIM_ADD_REP
Usage Example:
fim_del¶
Remove a File Integrity Monitoring watch.
Platforms: macOS | Windows | Linux
Parameters:
file_path(required): Path pattern to stop monitoring
Response Event: FIM_REMOVE (note: event name is FIM_REMOVE, not FIM_DEL_REP)
Usage Example:
fim_get¶
List all active File Integrity Monitoring watches on the sensor.
Platforms: macOS | Windows | Linux
Parameters: None
Response Event: FIM_LIST_REP
Usage Example:
get_debug_data¶
Retrieve internal sensor debug data for troubleshooting.
Platforms: Windows
Parameters: None
Response Event: DEBUG_DATA_REP
Usage Example:
Sensors running version 5.3.6 or later include a LOSS_ACCOUNTING sequence in the reply, reporting how many events the sensor's outbound queue has evicted or refused (in events and in bytes), how deep the queue currently is, and the bounds it is enforcing. See the LOSS_ACCOUNTING field reference for a description of each value.
hidden_module_scan¶
Scan for hidden or stealthy modules loaded in process memory that may not appear in normal module lists.
Platforms: Windows
Parameters:
pid(optional): Specific process ID to scan (default: all processes)
Response Event: HIDDEN_MODULE_DETECTED
Usage Example:
history_dump¶
Export a dump of recent events from the sensor's local event cache.
Platforms: macOS | Windows | Linux | Chrome | Edge
Parameters: None
Response Event: HISTORY_DUMP_REP
Usage Example:
log_get¶
Retrieve Windows Event Logs or macOS Unified Logs from the endpoint.
Platforms: Windows (Event Logs) | macOS (Unified Logs)
Parameters:
source(Windows required): Event log source name (e.g., "Security", "System")predicate(macOS optional): Unified log filter predicate
Response Event: LOG_GET_REP
Usage Example:
# Windows
limacharlie sensor task <SID> log_get --source "Security"
# macOS
limacharlie sensor task <SID> log_get --predicate "eventType == logEvent"
mem_find_string¶
Search process memory for specific string patterns.
Platforms: macOS | Windows | Linux
Parameters:
pid(required): Process ID to scanstrings(required): String or list of strings to search for
Response Event: MEM_FIND_STRING_REP
Usage Example:
mem_find_handle¶
Find handles (file, registry, process) held by a process on Windows.
Platforms: Windows
Parameters:
pid(optional): Specific process ID (default: all processes)needle(optional): Handle name pattern to search for
Response Event: MEM_FIND_HANDLE_REP
Usage Example:
mem_map¶
Get memory map of a process showing loaded modules and memory regions.
Platforms: macOS | Windows | Linux
Parameters:
pid(required): Process ID to map
Response Event: MEM_MAP_REP
Usage Example:
mem_read¶
Read raw memory from a process at a specific address.
Platforms: macOS | Windows | Linux
Parameters:
pid(required): Process IDbase_address(required): Memory address to read from (hex format)size(required): Number of bytes to read
Response Event: MEM_READ_REP
Usage Example:
mem_strings¶
Extract all readable strings from a process's memory.
Platforms: macOS | Windows | Linux
Parameters:
pid(required): Process ID to scan
Response Event: MEM_STRINGS_REP
Usage Example:
netstat¶
Get current network connections on the endpoint (similar to netstat command).
Platforms: macOS | Windows | Linux
Parameters: None
Response Event: NETWORK_CONNECTIONS
Usage Example:
Sample Response:
{
"event": {
"NETWORK_ACTIVITY": [
{
"STATE": "ESTABLISHED",
"LOCAL_ADDRESS": "192.168.1.100",
"LOCAL_PORT": 50234,
"REMOTE_ADDRESS": "93.184.216.34",
"REMOTE_PORT": 443,
"PID": 1234,
"PROCESS": "chrome.exe"
}
]
}
}
network_summary¶
Get aggregated network statistics and active connections summary.
Platforms: macOS | Windows | Linux
Parameters: None
Response Event: NETWORK_SUMMARY
Usage Example:
os_kill_process¶
Terminate a running process.
Platforms: macOS | Windows | Linux
Parameters:
pid(required): Process ID to terminate
Response Event: OS_KILL_PROCESS_REP
Usage Example:
os_packages¶
List installed software packages on the endpoint.
Platforms: Windows (via registry) | macOS (future) | Linux (future)
Response Event: OS_PACKAGES_REP
Usage Example:
Sample Response:
{
"event": {
"PACKAGES": [
{
"NAME": "Google Chrome",
"VERSION": "120.0.6099.130",
"PUBLISHER": "Google LLC"
}
]
}
}
os_processes¶
Get a list of all running processes with detailed information.
Platforms: macOS | Windows | Linux
Parameters: None
Response Event: EXISTING_PROCESS (multiple events, one per process)
Usage Example:
Sample Response:
{
"event": {
"PROCESS_ID": 1234,
"PARENT_PROCESS_ID": 5678,
"COMMAND_LINE": "C:\\Windows\\System32\\notepad.exe",
"FILE_PATH": "C:\\Windows\\System32\\notepad.exe",
"USER_NAME": "DOMAIN\\user"
}
}
os_resume¶
Resume a suspended process.
Platforms: macOS | Windows | Linux
Parameters:
pid(required): Process ID to resume
Response Event: OS_RESUME_REP
Usage Example:
os_services¶
List all services/daemons running on the endpoint.
Platforms: macOS | Windows | Linux
Parameters: None
Response Event: OS_SERVICES_REP
Usage Example:
os_suspend¶
Suspend (pause) a running process.
Platforms: macOS | Windows | Linux
Parameters:
pid(required): Process ID to suspend
Response Event: OS_SUSPEND_REP
Usage Example:
os_autoruns¶
List programs configured to run automatically at system startup.
Platforms: macOS | Windows | Linux
Parameters: None
Response Event: OS_AUTORUNS_REP
Usage Example:
os_drivers¶
List all loaded kernel drivers/modules.
Platforms: macOS | Windows | Linux
Parameters: None
Response Event: OS_DRIVERS_REP
Usage Example:
os_version¶
Get detailed operating system version information.
Platforms: macOS | Windows | Linux
Parameters: None
Response Event: OS_VERSION_REP
Usage Example:
Sample Response:
rejoin_network¶
Re-enable network connectivity for a sensor that was previously isolated.
Platforms: macOS | Windows | Linux | Chrome | Edge
Parameters: None
Response Event: None (sensor reconnects)
Usage Example:
run¶
Execute a command or script on the endpoint (out-of-band execution).
Platforms: macOS | Linux
Parameters:
command(required): Command line to execute
Response Event: EXEC_OOB
Usage Example:
segregate_network¶
Isolate a sensor from the network (except LimaCharlie cloud connectivity).
Platforms: macOS | Windows | Linux | Chrome | Edge
Parameters: None
Response Event: None (sensor becomes isolated)
Usage Example:
uninstall¶
Uninstall the sensor from the endpoint.
Platforms: macOS | Windows | Linux
Parameters:
--is-confirmed(required): Must be specified as a confirmation that you want to uninstall the sensor--msi(optional): Windows only — must be specified if the sensor was installed via MSI--native(optional): Use the sensor's built-in (native) uninstall procedure instead of the default legacy shell-based procedure
By default, the sensor uninstalls itself by running a shell command that invokes the on-disk agent's own uninstaller. This legacy procedure works on every sensor version. With --native, the sensor performs the uninstallation itself without spawning a shell command.
Note:
--nativerequires sensor version 5.3.3 or later. Older sensors silently ignore the native uninstall request — nothing happens on the endpoint. If you are unsure of a sensor's version, omit--native.
--msi takes precedence over --native: the native procedure does not unregister the MSI product, so sensors installed via MSI should use --msi.
Response Event: None (sensor uninstalls and disconnects)
Usage Example:
limacharlie sensor task <SID> uninstall --is-confirmed
limacharlie sensor task <SID> uninstall --is-confirmed --native
upgrade_core¶
Task the sensor to upgrade its own on-disk agent (the installed service) to a new release. The sensor downloads, verifies, and installs the release itself; if the new version fails to start, it automatically rolls back to the previous one. See Service Upgrades for the full upgrade procedure.
Platforms: macOS | Windows | Linux
Parameters:
--beta(required): Opt in to the native upgrade procedure; the command is rejected without it while the feature is in beta--force(optional): Upgrade even if the sensor already reports the latest available release--version(optional): Pin the exact release to install (e.g.5.3.3), downgrades included; defaults to the latest available release
Note: Requires sensor version 5.3.3 or later. Sensors running an older version silently drop the request and no upgrade takes place.
Response Event: None
Usage Example:
limacharlie sensor task <SID> upgrade_core --beta
limacharlie sensor task <SID> upgrade_core --beta --version 5.3.3
yara_scan¶
Scan files or process memory with YARA rules.
Platforms: macOS | Windows | Linux
Parameters:
rule(required): YARA rule contentfile_path(optional): Specific file to scanpid(optional): Specific process to scanprocess_expr(optional): Process name pattern to scan
Response Event: YARA_DETECTION
Usage Example:
# Scan a file
limacharlie sensor task <SID> yara_scan --file_path "C:\\suspicious.exe" --rule "rule test { strings: $a = \"malware\" condition: $a }"
# Scan process memory
limacharlie sensor task <SID> yara_scan --pid 1234 --rule "rule test { strings: $a = \"malware\" condition: $a }"
pcap_ifaces¶
List available network interfaces for packet capture.
Platforms: macOS | Windows | Linux
Parameters: None
Response Event: PCAP_INTERFACES_REP
Usage Example:
pcap_start¶
Start capturing network packets on a specified interface.
Platforms: macOS | Windows | Linux
Parameters:
iface(required): Network interface ID or namemax_size(optional): Maximum capture size in MB
Response Event: PCAP_START_REP
Usage Example:
pcap_stop¶
Stop an active packet capture and upload the PCAP file.
Platforms: macOS | Windows | Linux
Parameters:
iface(optional): Specific interface to stop (default: all)
Response Event: PCAP_STOP_REP, followed by EXPORT_COMPLETE
Usage Example:
reg_list¶
List Windows registry keys and values.
Platforms: Windows
Parameters:
reg(required, positional): Registry path to list. Must start with one ofhkcr,hkcc,hkcu,hklm,hku(e.g.,hklm\software). Backslashes must be escaped.
Response Event: REGISTRY_LIST_REP
Usage Example:
reg_get¶
Fetch a single named value from a Windows registry key. Complements reg_list, which enumerates a whole key.
Note: Added in sensor version 5.3.0.
Platforms: Windows
Parameters:
reg(required, positional): Registry key to read from. Must start with one ofhkcr,hkcc,hkcu,hklm,hku(e.g.,hklm\software). Backslashes must be escaped.name(optional, positional): Name of the value to fetch; omit for the key's default (unnamed) value
Response Event: REGISTRY_GET_REP
Usage Example:
limacharlie sensor task <SID> reg_get "hklm\\software\\microsoft\\windows\\currentversion\\run" "OneDrive"
epp_scan¶
Trigger an Endpoint Protection (EPP) scan on a file or directory.
Platforms: Windows
Parameters:
file_path(required): Path to scan
Response Event: EPP_SCAN_REP
Usage Example:
epp_list_exclusions¶
List EPP scan exclusions currently configured on the sensor.
Platforms: Windows
Parameters: None
Response Event: EPP_LIST_EXCLUSIONS_REP
Usage Example:
epp_add_exclusion¶
Add a path, process or file extension to EPP scan exclusions.
Platforms: Windows
Parameters:
value(positional, required): Value of the exclusion to add (a file/directory path, a process name, or a file extension)--type/-t(required): Type of exclusion. Options are:extension,path,process
Response Event: EPP_ADD_EXCLUSION_REP
Usage Example:
limacharlie sensor task <SID> epp_add_exclusion "C:\\safe_app" --type path
limacharlie sensor task <SID> epp_add_exclusion "safe_app.exe" --type process
epp_rem_exclusion¶
Remove a path, process or file extension from EPP scan exclusions.
Platforms: Windows
Parameters:
value(positional, required): Value of the exclusion to remove (a file/directory path, a process name, or a file extension)--type/-t(required): Type of exclusion. Options are:extension,path,process
Response Event: EPP_REM_EXCLUSION_REP
Usage Example:
epp_list_quarantine¶
List files currently in EPP quarantine.
Platforms: Windows
Parameters: None
Response Event: EPP_LIST_QUARANTINE_REP
Usage Example:
Command Usage Notes¶
General Syntax:
Platform Abbreviations:
- macOS: Apple macOS and OS X
- Windows: Microsoft Windows (7, 8, 10, 11, Server editions)
- Linux: Linux distributions (Ubuntu, CentOS, Debian, etc.)
- Chrome: Chrome browser extension sensor
- Edge: Microsoft Edge browser extension sensor
Response Events:
Most commands generate a response event (typically ending in _REP) that can be:
- Viewed in the LimaCharlie web interface under Sensor > Timeline
- Retrieved via API
- Triggered on with D&R rules
Error Handling:
Response events typically include an ERROR field:
ERROR: 0indicates success- Non-zero ERROR values indicate specific error conditions
Permissions: Some commands require elevated privileges (root/administrator) on the endpoint to execute successfully.
Timeouts: Commands have default timeouts (typically 30-60 seconds). Long-running operations may timeout and can be made persistent using the Reliable Tasking extension.