- Print
- DarkLight
This documentation version is deprecated, please click here for the latest version.
Article summary
Did you find this summary helpful?
Thank you for your feedback
In addition to LimaCharlie's powerful custom detection & response capabilities, we also offer native integration with several managed rulesets. LimaCharlie currently offers:
- Sigma Rules
- SnapAttack Community Edition
- SOC Prime
- Soteria
- AWS
- EDR
- Microsoft/Office 365
A Word on Managed Rulesets
While managed rulesets can help your organizations achieve detection and response capabilities quickly, not all detections are suitable for every environment.
Ensure that you are fine-tuning managed rulesets within your environment via enabling/disabling rules or via False Positive controls.
Managed rulesets offer several advantages, such as:
- Providing out-of-the-box coverage for common threats, reducing the time and effort to develop in-house rules.
- Curated rulesets are maintained and updated by their respective parties, often covering the latest threats.
- A foundation for building complex detection logic utilizing managed rulesets as inspiration.
Every environment is unique, and we recommend choosing rulesets that benefit your need(s) and/or use case(s).
Was this article helpful?