How can I see the activity that occurred before LimaCharlie sensor was installed?

To get the activity that occurred before the agent was installed into the LimaCharlie, you would want to use our Artifact Ingestion functionality.

For example, on Windows machines you can configure Artifact Ingestion (or do it manually via the artifact_get command) to get the raw Windows Event Logs from the endpoint containing old records.