Sensors & Outputs

How to collect PCAPs from Linux using the LC sensor?

Written by Ross
Updated over a week ago

How do I install the EDR sensor on Linux?

Written by Christopher Luft
Updated over a week ago

How do I install sensors in VMs and containers?

Written by Christopher Luft
Updated over a week ago

How can I manually uninstall the LimaCharlie sensor from a Windows endpoint?

Written by Amrik Randhawa
Updated over a week ago

Why do I see Error 223 on some Code Identity events?

Code identity events can show Error 223 when the file is too large

Written by Amrik Randhawa
Updated over a week ago

How can I tell which installation key was used to enrol a sensor?

Use the Installation ID to find which installation key was used to onboard an endpoint in LimaCharlie.

Written by Amrik Randhawa
Updated over a week ago

How much data does the LimaCharlie sensor produce per day?

Written by Ross
Updated over a week ago

How do I configure sensors in my tenant to auto-update to the new version?

Written by Ross
Updated over a week ago

How do I test a new sensor version before updating all sensors in my tenant?

Written by Ross
Updated over a week ago

How can I delete a sensor installation key?

Written by Ross
Updated over a week ago

Will LimaCharlie sensor get picked up by anti-virus software?

Written by Ross
Updated over a week ago

How much resources does the LimaCharlie sensor consume?

Written by Ross
Updated over a week ago

How can I restore a sensor that have been deleted?

Written by Ross
Updated over a week ago

What happens when the host is offline?

Written by Ross
Updated over a week ago

Why does my sensor initially connect successfully but then disappears?

Written by Ross
Updated over a week ago

How can I see the activity that occurred before LimaCharlie sensor was installed?

Written by Ross
Updated over a week ago

How do I troubleshoot the sensor issue?

Written by Ross
Updated over a week ago

How can I remove LimaCharlie sensor from all the endpoints in my network?

Learn how to uninstall the LimaCharlie sensor

Written by Ross
Updated over a week ago

How can I use tags?

Written by Ross
Updated over a week ago

How do I know if an EDR sensor was removed, but still has the service running and reaching out?

Written by Ross
Updated over a week ago

How do I remove tags from a sensor?

Written by Ross
Updated over a week ago

How can I use lc:sleep tag when deploying LC in a sleeper mode?

Written by Ross
Updated over a week ago

How do I ingest logs or telemetry from cloud-based external sources?

Written by Ross
Updated over a week ago

1Password Business

Written by Amrik Randhawa
Updated over a week ago

How to bring Microsoft Office 365 logs into LimaCharlie?

Written by Ross
Updated over a week ago

How to bring Microsoft Defender logs into LimaCharlie?

Written by Maxime Lamothe-Brassard
Updated over a week ago

How to get realtime Syslog ingestion with LimaCharlie

Get Syslog data coming into LimaCharlie in realtime

Written by Amrik Randhawa
Updated over a week ago

How to connect Google Cloud logs to LimaCharlie

Guide on connecting the Google Cloud Platform (GCP) logs into LimaCharlie using the Adapter.

Written by Maxime Lamothe-Brassard
Updated over a week ago

How can I collect Duo logs?

Written by Ross
Updated over a week ago

How can I collect Windows Event Logs through LimaCharlie Adapter, without installing the LC agent on the endpoint?

Written by Ross
Updated over a week ago

Does the Chrome sensor give me full network telemetry?

Written by Ross
Updated over a week ago

What events are captured by the Chrome sensor?

Written by Ross
Updated over a week ago

How can I troubleshoot the Chrome Extension connectivity issues?

Written by Ross
Updated over a week ago

How do I get external artifacts ingested into LimaCharlie?

Written by Ross
Updated over a week ago

How to get Sysmon data from the Windows endpoints into LimaCharlie?

Written by Ross
Updated over a week ago

How do I get Windows Event Logs (WEL) into LimaCharlie?

Written by Ross
Updated over a week ago

The documentation mentions an event when an artifact is uploaded but I can't see it in the Exfil Control. Why is that?

Written by Ross
Updated over a week ago

How can I decide what events should be sent to the cloud? What is Exfil Control?

Written by Ross
Updated over a week ago

How long will LimaCharlie store the data collected in "dormant" mode?

Written by Ross
Updated over a week ago

How can I push telemetry to Chronicle?

Learn how to send LimaCharlie telemetry to Google Chronicle

Written by Amrik Randhawa
Updated over a week ago

How to send data from LimaCharlie to Splunk?

Written by Ross
Updated over a week ago

How to send data from LimaCharlie to Google Cloud BigQuery?

Written by Ross
Updated over a week ago

How do I send detections from LimaCharlie to an email?

Written by Ross
Updated over a week ago

Can I rely on specific IP addresses to add to my allow list (whitelist) for Outputs?

Written by Ross
Updated over a week ago

How can I test if my outputs are configured correctly?

Written by Ross
Updated over a week ago

Where can I find the output configuration error details?

Written by Ross
Updated over a week ago